Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542877
MD5:	b4273d23536648914f8fae0c6e806829
SHA1:	85ebb2740cef470ef02feb52335f52b9d742870b
SHA256:	94daeaf15de4567f70707aa861a0613f353b7bd89d41dfa4f2bce0e735fa336f
Tags:	exeHealeruser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5088 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B4273D23536648914F8FAE0C6E806829)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0114C5E4 CryptVerifySignatureA,

0_2_0114C5E4

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2158455130.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153	0_2_010EE153
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE0D4	0_2_010EE0D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01173DB9	0_2_01173DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01179C79	0_2_01179C79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01142CBD	0_2_01142CBD

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 011475D9 appears 35 times

Source: file.exe, 00000000.00000000.2137679116.0000000000F66000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2861056 > 1048576

Source: file.exe

Static PE information: Raw size of vqiqbufx is bigger than: 0x100000 < 0x2b4800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f60000.0.unpack :EW;.rsrc:W;.idata :W;vqiqbufx:EW;hbokhmlx:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2bcc1a should be: 0x2c5c48

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: vqiqbufx
Source: file.exe	Static PE information: section name: hbokhmlx
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6E6CA push ecx; mov dword ptr [esp], 7B64EB61h	0_2_00F6F5C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6E76E push 5817B7E7h; mov dword ptr [esp], ecx	0_2_00F6E9A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F709F6 push 3FC29AA6h; mov dword ptr [esp], edx	0_2_00F70A13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F709F6 push ebx; mov dword ptr [esp], eax	0_2_00F7127C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1D4D push 3DA19AF8h; mov dword ptr [esp], edi	0_2_010F1D7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1D4D push edi; mov dword ptr [esp], 7BEFA197h	0_2_010F1DA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1D4D push 21BC37D0h; mov dword ptr [esp], ebp	0_2_010F1E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1D4D push 6C5B7066h; mov dword ptr [esp], eax	0_2_010F1E6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1EC3 push eax; mov dword ptr [esp], 4D243B96h	0_2_010F1FE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120D120 push esi; mov dword ptr [esp], eax	0_2_0120D2AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F730FB push edx; mov dword ptr [esp], ebx	0_2_00F7310F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F730FB push 4E346000h; mov dword ptr [esp], esi	0_2_00F73117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110011C push edi; mov dword ptr [esp], 1F94A047h	0_2_01100135
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110011C push 6D2BD856h; mov dword ptr [esp], esi	0_2_0110015C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6D0E8 push 3D4509C3h; mov dword ptr [esp], ebx	0_2_00F6D211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F710B6 push 5E840305h; mov dword ptr [esp], ebx	0_2_00F73DD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F750B0 push eax; mov dword ptr [esp], 1E6DC74Ah	0_2_00F757A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6C0A6 push 758A4381h; mov dword ptr [esp], eax	0_2_00F6C0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6C0A6 push edx; mov dword ptr [esp], 6AFEE352h	0_2_00F6C0B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push ebp; mov dword ptr [esp], ecx	0_2_010EE16B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push 55054CD1h; mov dword ptr [esp], edx	0_2_010EE173
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push 58ECB2C6h; mov dword ptr [esp], edx	0_2_010EE1C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push 4CBF50D8h; mov dword ptr [esp], edx	0_2_010EE25A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push 75EBE700h; mov dword ptr [esp], ecx	0_2_010EE2D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE153 push eax; mov dword ptr [esp], 6D706C06h	0_2_010EE326
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FE16E push 6D52CCEFh; mov dword ptr [esp], ebp	0_2_01100E27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6C08F push 72A689E0h; mov dword ptr [esp], ebx	0_2_00F6C9CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FE176 push esi; mov dword ptr [esp], edi	0_2_010FE198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FE176 push ebp; mov dword ptr [esp], 6DDD7E2Bh	0_2_010FE38F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117F194 push 5356AC5Eh; mov dword ptr [esp], esi	0_2_0117F19C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011791BB push edx; mov dword ptr [esp], edi	0_2_011791D5

Source: file.exe

Static PE information: section name: entropy: 7.794154084052554

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DC9B second address: F6DCA5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F80A07F098Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2C5C second address: 10F2C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2C62 second address: 10F2C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2C68 second address: 10F2C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F80A12AE2F5h 0x0000000c jmp 00007F80A12AE2EAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2C8E second address: 10F2C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E61D1 second address: 10E61ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E61ED second address: 10E61FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1BC3 second address: 10F1BCB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1BCB second address: 10F1BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F80A07F0986h 0x0000000a jng 00007F80A07F0986h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2015 second address: 10F2029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F80A12AE2EBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2029 second address: 10F203D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F098Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F203D second address: 10F20AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F80A12AE2F2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007F80A12AE2F8h 0x00000013 jc 00007F80A12AE2E6h 0x00000019 jmp 00007F80A12AE2ECh 0x0000001e pushad 0x0000001f jmp 00007F80A12AE2F5h 0x00000024 jns 00007F80A12AE2E6h 0x0000002a jmp 00007F80A12AE2F1h 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 pop esi 0x00000034 jmp 00007F80A12AE2EBh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F20AC second address: 10F20B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F235D second address: 10F2377 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F80A12AE2F5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2377 second address: 10F2380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2380 second address: 10F239B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F24EF second address: 10F24F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F24F5 second address: 10F2505 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jg 00007F80A12AE2EEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4C1B second address: F6DC9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F80A07F0994h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 0F64208Eh 0x00000012 sbb dl, 0000002Ch 0x00000015 push dword ptr [ebp+122D002Dh] 0x0000001b call dword ptr [ebp+122D2200h] 0x00000021 pushad 0x00000022 pushad 0x00000023 sub ebx, dword ptr [ebp+122D39EEh] 0x00000029 popad 0x0000002a xor eax, eax 0x0000002c jmp 00007F80A07F0994h 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 sub dword ptr [ebp+122D29CBh], ebx 0x0000003b mov dword ptr [ebp+122D3982h], eax 0x00000041 cmc 0x00000042 mov esi, 0000003Ch 0x00000047 jng 00007F80A07F0987h 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 sub dword ptr [ebp+122D31B5h], eax 0x00000057 js 00007F80A07F0987h 0x0000005d cmc 0x0000005e lodsw 0x00000060 clc 0x00000061 mov dword ptr [ebp+122D29CBh], esi 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D31B5h], esi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 cmc 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007F80A07F098Bh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D5E second address: 10F4D64 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D64 second address: 10F4D7A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F80A07F0988h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F80A07F0986h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D7A second address: 10F4E03 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F80A12AE2EBh 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b jmp 00007F80A12AE2EAh 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 jmp 00007F80A12AE2F5h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f jno 00007F80A12AE2E8h 0x00000035 pushad 0x00000036 jmp 00007F80A12AE2F3h 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e popad 0x0000003f pop eax 0x00000040 mov edi, ebx 0x00000042 lea ebx, dword ptr [ebp+1245AB82h] 0x00000048 mov dx, 1696h 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F80A12AE2EFh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4E03 second address: 10F4E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4E09 second address: 10F4E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4E0D second address: 10F4E1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4F20 second address: 10F4F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F80A12AE2F8h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F80A12AE2ECh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4F4F second address: 10F4F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4F53 second address: 10F4FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F80A12AE2E6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 jmp 00007F80A12AE2F0h 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop edx 0x0000001a popad 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F80A12AE2E8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 or di, 8051h 0x0000003b mov edi, dword ptr [ebp+122D2AB2h] 0x00000041 lea ebx, dword ptr [ebp+1245AB8Bh] 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F80A12AE2E8h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 jmp 00007F80A12AE2EFh 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a jng 00007F80A12AE2E6h 0x00000070 jnp 00007F80A12AE2E6h 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5033 second address: 10F5038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F5038 second address: 10F506E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F80A12AE2E6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D2C57h], ebx 0x00000015 push 00000000h 0x00000017 movsx ecx, di 0x0000001a call 00007F80A12AE2E9h 0x0000001f pushad 0x00000020 jmp 00007F80A12AE2EEh 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F506E second address: 10F507A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F507A second address: 10F50A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F80A12AE2ECh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F80A12AE2F3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F50A9 second address: 10F50AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F50AF second address: 10F50C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jbe 00007F80A12AE2F0h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F50C3 second address: 10F513F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jbe 00007F80A07F0994h 0x00000010 jmp 00007F80A07F098Eh 0x00000015 pop eax 0x00000016 mov cl, bl 0x00000018 jmp 00007F80A07F0994h 0x0000001d push 00000003h 0x0000001f je 00007F80A07F098Eh 0x00000025 push eax 0x00000026 mov dword ptr [ebp+122D30F6h], eax 0x0000002c pop esi 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+12457F9Dh], esi 0x00000035 push 00000003h 0x00000037 push D12984BEh 0x0000003c push edi 0x0000003d jg 00007F80A07F0988h 0x00000043 pop edi 0x00000044 xor dword ptr [esp], 112984BEh 0x0000004b lea ebx, dword ptr [ebp+1245AB96h] 0x00000051 mov dword ptr [ebp+122D30E2h], edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jp 00007F80A07F0988h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F513F second address: 10F5145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114456 second address: 111445A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111445A second address: 111447B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F80A12AE2F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111447B second address: 1114481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114481 second address: 111449C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jg 00007F80A12AE2E6h 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111449C second address: 11144B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F80A07F0992h 0x00000008 jmp 00007F80A07F098Ch 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114615 second address: 111462A instructions: 0x00000000 rdtsc 0x00000002 js 00007F80A12AE2ECh 0x00000008 jnc 00007F80A12AE2E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111462A second address: 1114630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114630 second address: 111463B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114A8E second address: 1114A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114A92 second address: 1114ABF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007F80A12AE2E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F80A12AE2EBh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F80A12AE2F4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114ABF second address: 1114AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114C24 second address: 1114C35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F80A12AE2E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114C35 second address: 1114C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F80A07F0986h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114F09 second address: 1114F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11150A6 second address: 11150AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11150AE second address: 11150B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153CC second address: 11153D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153D5 second address: 11153D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153D9 second address: 11153F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F80A07F0994h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11153F5 second address: 1115401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115401 second address: 1115405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115405 second address: 1115409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115409 second address: 111541E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a push edi 0x0000000b jc 00007F80A07F0986h 0x00000011 pop edi 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11155A4 second address: 11155BA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F80A12AE2E6h 0x00000008 jne 00007F80A12AE2E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11155BA second address: 11155BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11155BE second address: 11155E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111572F second address: 1115737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108997 second address: 110899D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA5A6 second address: 10DA5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA5AA second address: 10DA5BE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F80A12AE2E6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F80A12AE2ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA5BE second address: 10DA5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F80A07F0998h 0x0000000b jng 00007F80A07F0986h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115908 second address: 1115922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2ECh 0x00000009 jnp 00007F80A12AE2E6h 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115922 second address: 1115927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115927 second address: 111592C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115EA0 second address: 1115EB0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F80A07F098Eh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111603F second address: 1116043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116043 second address: 111604E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111604E second address: 111606D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F80A12AE2F4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11165C1 second address: 1116601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0992h 0x00000009 jmp 00007F80A07F0996h 0x0000000e popad 0x0000000f push edi 0x00000010 jmp 00007F80A07F098Bh 0x00000015 jns 00007F80A07F0986h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117CDF second address: 1117CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118EDB second address: 1118EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111AF70 second address: 111AF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2EFh 0x00000009 pop esi 0x0000000a jng 00007F80A12AE2EEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121787 second address: 112178B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112178B second address: 11217A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121A95 second address: 1121AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F80A07F0986h 0x0000000f jl 00007F80A07F0986h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121AAA second address: 1121AB4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121AB4 second address: 1121ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121ABA second address: 1121ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122058 second address: 112205E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112283D second address: 1122842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122965 second address: 1122994 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F80A07F0988h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jnl 00007F80A07F0998h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122994 second address: 11229A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F80A12AE2E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11229A2 second address: 11229C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F80A07F0993h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122AF1 second address: 1122AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122C59 second address: 1122C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112358F second address: 11235A1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F80A12AE2E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11237F2 second address: 11237FC instructions: 0x00000000 rdtsc 0x00000002 js 00007F80A07F0986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123911 second address: 1123915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123915 second address: 112391F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112391F second address: 1123923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11239EA second address: 11239EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112411A second address: 112412A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2EBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112529D second address: 11252A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11252A1 second address: 11252BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7D3B second address: 10E7D52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F80A07F098Eh 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11252BF second address: 11252C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11252C5 second address: 11252CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127C54 second address: 1127CF8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F80A12AE2E8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov di, ax 0x00000028 jnc 00007F80A12AE303h 0x0000002e push 00000000h 0x00000030 jmp 00007F80A12AE2F8h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F80A12AE2E8h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F80A12AE2F2h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B42E second address: 112B432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B432 second address: 112B438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C019 second address: 112C067 instructions: 0x00000000 rdtsc 0x00000002 js 00007F80A07F0986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F80A07F098Ch 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 cld 0x00000014 push 00000000h 0x00000016 call 00007F80A07F098Eh 0x0000001b adc si, 257Eh 0x00000020 pop esi 0x00000021 push 00000000h 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F80A07F0998h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C067 second address: 112C086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C086 second address: 112C08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129AAB second address: 1129AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129AB6 second address: 1129ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0990h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EBBD second address: 112EBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BD30 second address: 112BD34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132927 second address: 1132940 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F80A12AE2ECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132940 second address: 1132946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132946 second address: 11329AF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F80A12AE2E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jnl 00007F80A12AE2E8h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F80A12AE2E8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d jmp 00007F80A12AE2F0h 0x00000032 jmp 00007F80A12AE2F2h 0x00000037 push 00000000h 0x00000039 mov edi, dword ptr [ebp+122D2ADFh] 0x0000003f push eax 0x00000040 pushad 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11329AF second address: 11329D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0995h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F80A07F098Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134A44 second address: 1134ABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F80A12AE2F5h 0x0000000f popad 0x00000010 nop 0x00000011 movzx ebx, dx 0x00000014 push 00000000h 0x00000016 sub dword ptr [ebp+12458E2Bh], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F80A12AE2E8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b je 00007F80A12AE2FEh 0x00000041 jmp 00007F80A12AE2F8h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113090F second address: 11309AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0997h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007F80A07F099Fh 0x00000010 jmp 00007F80A07F0999h 0x00000015 nop 0x00000016 mov dword ptr [ebp+122D379Eh], edi 0x0000001c push dword ptr fs:[00000000h] 0x00000023 sub edi, 761CEBAEh 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F80A07F0988h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a cmc 0x0000004b mov eax, dword ptr [ebp+122D1585h] 0x00000051 jmp 00007F80A07F098Ah 0x00000056 push FFFFFFFFh 0x00000058 mov ebx, dword ptr [ebp+122D3173h] 0x0000005e push eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F80A07F098Bh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136CE1 second address: 1136CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136CE5 second address: 1136D60 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F80A07F0986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F80A07F0988h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov edi, 3023DE56h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 call 00007F80A07F0988h 0x00000037 pop esi 0x00000038 mov dword ptr [esp+04h], esi 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc esi 0x00000045 push esi 0x00000046 ret 0x00000047 pop esi 0x00000048 ret 0x00000049 call 00007F80A07F0992h 0x0000004e sub di, 3935h 0x00000053 pop ebx 0x00000054 xchg eax, esi 0x00000055 push ecx 0x00000056 jo 00007F80A07F098Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D60 second address: 1136D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F80A12AE2F8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11309AA second address: 11309B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131A79 second address: 1131A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131A7D second address: 1131B15 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F80A07F0988h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F80A07F0988h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jmp 00007F80A07F0998h 0x0000002a push dword ptr fs:[00000000h] 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F80A07F0988h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b movzx ebx, bx 0x0000004e mov dword ptr fs:[00000000h], esp 0x00000055 push edi 0x00000056 adc ebx, 1CE2F057h 0x0000005c pop edi 0x0000005d mov eax, dword ptr [ebp+122D0745h] 0x00000063 jp 00007F80A07F0987h 0x00000069 push FFFFFFFFh 0x0000006b mov dword ptr [ebp+122D2B78h], edx 0x00000071 push eax 0x00000072 pushad 0x00000073 push ecx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133BAF second address: 1133BEA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F80A12AE2FCh 0x00000008 jmp 00007F80A12AE2F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jmp 00007F80A12AE2F6h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134C83 second address: 1134D35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0991h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F80A07F0988h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F80A07F0994h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov bx, CBE3h 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d jmp 00007F80A07F098Bh 0x00000042 jmp 00007F80A07F0993h 0x00000047 mov eax, dword ptr [ebp+122D064Dh] 0x0000004d mov edi, dword ptr [ebp+122D3AA6h] 0x00000053 push FFFFFFFFh 0x00000055 pushad 0x00000056 mov dword ptr [ebp+1245AEE3h], eax 0x0000005c jmp 00007F80A07F0992h 0x00000061 popad 0x00000062 jc 00007F80A07F0988h 0x00000068 mov ebx, edx 0x0000006a nop 0x0000006b jl 00007F80A07F098Eh 0x00000071 push edi 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136F9B second address: 1136F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136F9F second address: 1136FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136FA3 second address: 1136FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F80A12AE2E8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139E42 second address: 1139E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F80A07F0988h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BC3C second address: 113BCA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F80A12AE2E8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jmp 00007F80A12AE2F4h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c or bh, 00000035h 0x0000002f xchg eax, esi 0x00000030 jne 00007F80A12AE2FFh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BCA6 second address: 113BCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BCAB second address: 113BCB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A02A second address: 113A0E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F098Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F80A07F0996h 0x0000000f nop 0x00000010 mov bx, A5BEh 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F80A07F0988h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov edi, edx 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e cld 0x0000003f mov eax, dword ptr [ebp+122D05B1h] 0x00000045 push 00000000h 0x00000047 push ecx 0x00000048 call 00007F80A07F0988h 0x0000004d pop ecx 0x0000004e mov dword ptr [esp+04h], ecx 0x00000052 add dword ptr [esp+04h], 00000015h 0x0000005a inc ecx 0x0000005b push ecx 0x0000005c ret 0x0000005d pop ecx 0x0000005e ret 0x0000005f jmp 00007F80A07F098Eh 0x00000064 push FFFFFFFFh 0x00000066 mov bl, 39h 0x00000068 jmp 00007F80A07F0997h 0x0000006d nop 0x0000006e jmp 00007F80A07F0993h 0x00000073 push eax 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 push edi 0x00000078 pop edi 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BEE1 second address: 113BEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DBDD second address: 113DC2F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b cld 0x0000000c push 00000000h 0x0000000e mov ebx, dword ptr [ebp+122D3972h] 0x00000014 push 00000000h 0x00000016 pushad 0x00000017 mov eax, dword ptr [ebp+122D22DCh] 0x0000001d mov dword ptr [ebp+122D21B5h], ebx 0x00000023 popad 0x00000024 mov dword ptr [ebp+12458B9Dh], ebx 0x0000002a xchg eax, esi 0x0000002b jmp 00007F80A07F0992h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jl 00007F80A07F0992h 0x00000039 jmp 00007F80A07F098Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EBCE second address: 113EBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EBD2 second address: 113EBD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DDBB second address: 113DDDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DEB7 second address: 113DEBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FD2A second address: 113FD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FD30 second address: 113FD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EDC6 second address: 113EDD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F80A12AE2E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FEB9 second address: 113FEBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FEBE second address: 113FF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F80A12AE2E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, 1C10F9B5h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F80A12AE2E8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 jmp 00007F80A12AE2F9h 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 sub dword ptr [ebp+122D30F0h], eax 0x00000048 mov edi, dword ptr [ebp+122D2C8Ah] 0x0000004e mov eax, dword ptr [ebp+122D02B5h] 0x00000054 push 00000000h 0x00000056 push ebp 0x00000057 call 00007F80A12AE2E8h 0x0000005c pop ebp 0x0000005d mov dword ptr [esp+04h], ebp 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc ebp 0x0000006a push ebp 0x0000006b ret 0x0000006c pop ebp 0x0000006d ret 0x0000006e movzx ebx, si 0x00000071 push FFFFFFFFh 0x00000073 mov bh, 74h 0x00000075 mov dword ptr [ebp+122D30F0h], ebx 0x0000007b nop 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007F80A12AE2F9h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142C22 second address: 1142C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142C26 second address: 1142C3B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F80A12AE2E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d js 00007F80A12AE2EEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDB82 second address: 10DDB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0995h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDB9B second address: 10DDBA5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDBA5 second address: 10DDBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152AD3 second address: 1152AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jo 00007F80A12AE2E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152AE1 second address: 1152AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152AEC second address: 1152AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152AF0 second address: 1152B18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0995h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jl 00007F80A07F0986h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152B18 second address: 1152B2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152B2B second address: 1152B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F80A07F0998h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B95C second address: 115B97F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F80A12AE2F0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jbe 00007F80A12AE2EAh 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B97F second address: 115B993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0990h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B993 second address: 115B9AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F80A12AE2EEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9AA second address: 115B9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D3CE second address: 115D3E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F80A12AE2E6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007F80A12AE306h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11622B3 second address: 11622B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11622B9 second address: 11622C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007F80A12AE2E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161071 second address: 11610A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F80A07F098Dh 0x0000000d jbe 00007F80A07F0986h 0x00000013 jmp 00007F80A07F0998h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610A5 second address: 11610AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11618DE second address: 11618E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161F9F second address: 1161FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161FA3 second address: 1161FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161FA9 second address: 1161FC4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F80A12AE2F6h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165CEF second address: 1165D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0995h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165D08 second address: 1165D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F80A12AE2E6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F80A12AE2E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165D1E second address: 1165D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169161 second address: 1169178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D298 second address: 116D29C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D0BB second address: 112D0F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov cx, dx 0x0000000f lea eax, dword ptr [ebp+12492E80h] 0x00000015 mov edi, 561E7191h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jo 00007F80A12AE2E6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D0F0 second address: 112D0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D0F6 second address: 1108997 instructions: 0x00000000 rdtsc 0x00000002 js 00007F80A12AE2E8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jne 00007F80A12AE2ECh 0x00000015 call dword ptr [ebp+122D3142h] 0x0000001b push edx 0x0000001c jo 00007F80A12AE2ECh 0x00000022 jl 00007F80A12AE2E6h 0x00000028 jc 00007F80A12AE2F2h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4A2 second address: 112D4A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4A8 second address: 112D4B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4B7 second address: 112D4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4BB second address: 112D4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4C1 second address: 112D4C6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4C6 second address: F6DC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 adc dx, 0595h 0x0000000d mov dword ptr [ebp+122D3082h], esi 0x00000013 push dword ptr [ebp+122D002Dh] 0x00000019 jl 00007F80A12AE2E7h 0x0000001f call dword ptr [ebp+122D2200h] 0x00000025 pushad 0x00000026 pushad 0x00000027 sub ebx, dword ptr [ebp+122D39EEh] 0x0000002d popad 0x0000002e xor eax, eax 0x00000030 jmp 00007F80A12AE2F4h 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 sub dword ptr [ebp+122D29CBh], ebx 0x0000003f mov dword ptr [ebp+122D3982h], eax 0x00000045 cmc 0x00000046 mov esi, 0000003Ch 0x0000004b jng 00007F80A12AE2E7h 0x00000051 stc 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 sub dword ptr [ebp+122D31B5h], eax 0x0000005c js 00007F80A12AE2E7h 0x00000062 cmc 0x00000063 lodsw 0x00000065 clc 0x00000066 mov dword ptr [ebp+122D29CBh], esi 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D31B5h], esi 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a cmc 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007F80A12AE2EBh 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D63D second address: 112D6AB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F80A07F0997h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 1643E83Fh 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F80A07F0988h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push B5822964h 0x00000030 pushad 0x00000031 pushad 0x00000032 jne 00007F80A07F0986h 0x00000038 jmp 00007F80A07F098Fh 0x0000003d popad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F80A07F0991h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D8AA second address: 112D8F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jne 00007F80A12AE2ECh 0x0000000f jnl 00007F80A12AE2E6h 0x00000015 pop eax 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007F80A12AE2EDh 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F80A12AE2F8h 0x0000002a popad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DB52 second address: 112DB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F80A07F0998h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DB73 second address: 112DB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E13B second address: 112E168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F098Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jg 00007F80A07F098Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F80A07F098Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E28D second address: 112E293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E293 second address: 112E2BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0999h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jno 00007F80A07F0986h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E2BF second address: 112E2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E2C4 second address: 112E2EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F80A07F098Ch 0x00000008 js 00007F80A07F0986h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F80A07F098Eh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E3EF second address: 112E400 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jng 00007F80A12AE2ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E400 second address: 112E40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F80A07F098Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D94D second address: 116D957 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F80A12AE2E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D957 second address: 116D972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F80A07F0993h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172E02 second address: 1172E16 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172FAD second address: 1172FB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11733FA second address: 1173405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173405 second address: 1173418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jno 00007F80A07F0986h 0x0000000c js 00007F80A07F0986h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173418 second address: 1173443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F80A12AE2F5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007F80A12AE2E6h 0x00000012 popad 0x00000013 js 00007F80A12AE2EEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117381F second address: 117382A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178138 second address: 117813E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117813E second address: 1178186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F80A07F098Ch 0x0000000b pop edx 0x0000000c jmp 00007F80A07F0999h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F80A07F0999h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178186 second address: 11781A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F80A12AE2E6h 0x00000010 jmp 00007F80A12AE2EAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178457 second address: 117845D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117845D second address: 117847C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F80A12AE2F4h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117847C second address: 1178480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178E40 second address: 1178E45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB31 second address: 117BB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB35 second address: 117BB3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB3B second address: 117BB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB41 second address: 117BB5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB5C second address: 117BB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BB60 second address: 117BB8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EAh 0x00000007 jmp 00007F80A12AE2EEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F80A12AE2EAh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F0DC second address: 117F0F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F80A07F098Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F0F1 second address: 117F0FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F80A12AE2E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E8B5 second address: 117E8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EBE8 second address: 117EC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2EDh 0x00000009 popad 0x0000000a jbe 00007F80A12AE312h 0x00000010 jmp 00007F80A12AE2EAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007F80A12AE2E6h 0x0000001d jmp 00007F80A12AE2F0h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDB0 second address: 117EDB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDB6 second address: 117EDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDBA second address: 117EDBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDBE second address: 117EDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F80A12AE2F7h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F80A12AE2E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDE6 second address: 117EE0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F80A07F098Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F80A07F098Ch 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11839C5 second address: 11839C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183161 second address: 1183169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183169 second address: 118316D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF72D second address: 10DF731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF731 second address: 10DF735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF735 second address: 10DF73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF73B second address: 10DF751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F80A12AE2EBh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186C09 second address: 1186C37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0996h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F80A07F098Fh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186DA4 second address: 1186DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186F36 second address: 1186F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186F3A second address: 1186F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187345 second address: 1187360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F80A07F0996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187360 second address: 118736A instructions: 0x00000000 rdtsc 0x00000002 je 00007F80A12AE2ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D750 second address: 118D76E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A07F0992h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F80A07F0986h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D76E second address: 118D772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D772 second address: 118D778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C151 second address: 118C195 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EDh 0x00000007 push ebx 0x00000008 jnl 00007F80A12AE2E6h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F80A12AE2F7h 0x00000017 jmp 00007F80A12AE2F0h 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C6DC second address: 118C6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C6E1 second address: 118C6E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C6E7 second address: 118C6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C6EB second address: 118C6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D3D5 second address: 118D427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F80A07F0999h 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F80A07F098Fh 0x00000014 jl 00007F80A07F0986h 0x0000001a pop ecx 0x0000001b jmp 00007F80A07F0999h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195CB8 second address: 1195CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F80A12AE2E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195CC4 second address: 1195CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193C58 second address: 1193C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 jbe 00007F80A12AE2E6h 0x0000000e jmp 00007F80A12AE2F9h 0x00000013 pop edx 0x00000014 pop ecx 0x00000015 pushad 0x00000016 jmp 00007F80A12AE2ECh 0x0000001b jc 00007F80A12AE2EEh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11944F1 second address: 11944F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11944F7 second address: 11944FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11944FB second address: 1194503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194503 second address: 119451F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F80A12AE2F6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11947A3 second address: 11947BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007F80A07F0986h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jbe 00007F80A07F0986h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194DA0 second address: 1194DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194DA6 second address: 1194DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195324 second address: 1195328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195328 second address: 1195336 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F80A07F0986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195336 second address: 1195351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A12AE2F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195351 second address: 119535B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F80A07F0986h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195669 second address: 119566D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119566D second address: 119569B instructions: 0x00000000 rdtsc 0x00000002 js 00007F80A07F0986h 0x00000008 jmp 00007F80A07F098Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F80A07F0986h 0x00000017 jmp 00007F80A07F0991h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119569B second address: 11956B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F80A12AE2EEh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11956B7 second address: 11956C5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F80A07F0988h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11959AB second address: 11959BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jno 00007F80A12AE2E6h 0x0000000c pop esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E0D8 second address: 119E0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E501 second address: 119E505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E505 second address: 119E513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F80A07F0986h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E513 second address: 119E522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E522 second address: 119E52C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A89CC second address: 11A89E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F80A12AE2F4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A89E6 second address: 11A89FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F80A07F0993h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A89FD second address: 11A8A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7041 second address: 11A704B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F80A07F0986h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7467 second address: 11A748D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F80A12AE2E6h 0x00000009 jmp 00007F80A12AE2F9h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A748D second address: 11A749A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F80A07F098Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A76F3 second address: 11A76FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F80A12AE2E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79FB second address: 11A7A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7A01 second address: 11A7A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A881E second address: 11A8827 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8827 second address: 11A8832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8832 second address: 11A8878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F80A07F0993h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F80A07F0999h 0x00000013 jmp 00007F80A07F0991h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAF26 second address: 11AAF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAD82 second address: 11AAD88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAD88 second address: 11AADAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F80A12AE2EFh 0x00000007 jmp 00007F80A12AE2EDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AADAE second address: 11AADD9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F80A07F0986h 0x00000008 jmp 00007F80A07F098Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop ebx 0x00000017 jng 00007F80A07F098Eh 0x0000001d push eax 0x0000001e pop eax 0x0000001f jg 00007F80A07F0986h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AADD9 second address: 11AADE9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F80A12AE2EAh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AADE9 second address: 11AADEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AADEF second address: 11AADF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B053F second address: 11B0557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F80A07F098Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0557 second address: 11B055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B06BE second address: 11B06F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F80A07F0986h 0x0000000a jmp 00007F80A07F0996h 0x0000000f popad 0x00000010 jg 00007F80A07F098Eh 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F80A07F0986h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B06F1 second address: 11B06F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE1B5 second address: 11BE1BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE1BA second address: 11BE1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F80A12AE2EEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFE67 second address: 11BFE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFE6F second address: 11BFE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F80A12AE2E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD520 second address: 11DD524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD524 second address: 11DD538 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F80A12AE2ECh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD664 second address: 11DD68D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F80A07F0986h 0x00000008 jg 00007F80A07F0986h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F80A07F0999h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD68D second address: 11DD692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7EA second address: 11DD7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7F1 second address: 11DD7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7F9 second address: 11DD7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD93F second address: 11DD943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD943 second address: 11DD947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDAB8 second address: 11DDAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F80A12AE2F7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDAD8 second address: 11DDADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBF68 second address: 11EBF72 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F80A12AE2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBF72 second address: 11EBF7E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F80A07F098Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBEF4 second address: 11FBEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBEF8 second address: 11FBEFE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBEFE second address: 11FBF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBF04 second address: 11FBF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED95 second address: 11FED99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FED99 second address: 11FEDB6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F80A07F0995h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEDB6 second address: 11FEDBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEDBA second address: 11FEDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205B6C second address: 1205B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F80A12AE2E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205B78 second address: 1205B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205B7C second address: 1205B86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205B86 second address: 1205B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205B8A second address: 1205B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206088 second address: 12060B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 jmp 00007F80A07F098Ch 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 js 00007F80A07F0988h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F80A07F098Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12060B6 second address: 12060BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209ADF second address: 1209AE4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209AE4 second address: 1209AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120951A second address: 1209526 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209526 second address: 120952A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120952A second address: 120952E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211C2F second address: 1211C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121366E second address: 1213672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213672 second address: 1213678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215608 second address: 1215610 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215610 second address: 1215623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F80A12AE2EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215623 second address: 1215641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F80A07F0995h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AAF3 second address: 120AAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112555F second address: 1125569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F6DCB4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F6DC57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11458A4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11B4497 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F72A4A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 51C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010F1EC3 rdtsc

0_2_010F1EC3

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5532

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010F1EC3 rdtsc

0_2_010F1EC3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F6B782 LdrInitializeThunk,

0_2_00F6B782

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: qProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0114B726 GetSystemTime,GetFileTime,

0_2_0114B726

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542877
Start date and time:	2024-10-26 19:13:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.476224215505671
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'861'056 bytes
MD5:	b4273d23536648914f8fae0c6e806829
SHA1:	85ebb2740cef470ef02feb52335f52b9d742870b
SHA256:	94daeaf15de4567f70707aa861a0613f353b7bd89d41dfa4f2bce0e735fa336f
SHA512:	1ea9f3decf886193caf59da49fe53a8f69da9843b3a17e8779198d775c37877047c6094e074e5e71fe18fae92336ae43b65ee8669b3db020fda0d8c5aa01ed57
SSDEEP:	49152:1AwbkFS1Gl+CMsBjw/Yh8YTCX9BGlR+G5yUnQ6en6fn:OwbkFll+CMsdgYirtBeR+p6k6fn
TLSH:	66D55CA2B54A77CFD84E3BB895A7CD42995C03BA0B1408C7983CB4B97D63DC116FAD24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... ,.. ...`....@.. .......................`,.......+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6c2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F80A083600Ah
jbe 00007F80A0836031h
add byte ptr [eax], al
jmp 00007F80A0838005h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	79703ab91a93609aedf8e5550ae88026	False	0.9325086805555556	data	7.794154084052554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vqiqbufx	0xa000	0x2b6000	0x2b4800	130b4d0446c74c5ee8fe53f99d1fb716	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hbokhmlx	0x2c0000	0x2000	0x400	4efdbad6c5a6a0378546ad6d019b8a85	False	0.8203125	data	6.22619970360012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2c2000	0x4000	0x2200	7065f9e372f18f7fd0ad42d7729f7774	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	13:14:12
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf60000
File size:	2'861'056 bytes
MD5 hash:	B4273D23536648914F8FAE0C6E806829
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	4.3%
Signature Coverage:	1.8%
Total number of Nodes:	278
Total number of Limit Nodes:	10

Executed Functions

Function 010F1EC3 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 010F1EC3

Memory Dump Source

Source File: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f480eb9b589362b4dc459655e18afd242bfa73a8c8587e5b58bf2d2635d5e9b
Instruction ID: b848ed5d9d7c4444379beec400888c87b8f0c848d276d222a90f602e6bfe7be1
Opcode Fuzzy Hash: 6f480eb9b589362b4dc459655e18afd242bfa73a8c8587e5b58bf2d2635d5e9b
Instruction Fuzzy Hash: D4310FF250C600AFE302BF69D8857BAFBE5EF88320F16882DE6C4C2655E67455548B93

Function 00F6B782 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 00F6B8F2

Memory Dump Source

Source File: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 4c1dc7319c2b3e4aacc9b209f8b67f02d3282cc0c81dcbf32d076d0b92cd091b
Instruction ID: 1f0ebce4f3857772856fdb2251945940583fc39c27152b6cf719fe1dfa2551db
Opcode Fuzzy Hash: 4c1dc7319c2b3e4aacc9b209f8b67f02d3282cc0c81dcbf32d076d0b92cd091b
Instruction Fuzzy Hash: 2DE0C232A44AC58ADB16EF708C017993A1DEB40700F500124FA01CBE46DB3D4E53F755

Function 01148CAC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 01148DBD
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 01148DD1

Strings

.dll, xrefs: 01148CF4
1002, xrefs: 01148D87
.exe, xrefs: 01148D18

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: a70d8ddafe7d5efcacfa2dbaec4913ce7f416626137bf5dbfe0f4c7e2c42964f
Instruction ID: a47b15925066a262bac0a371e32a1fdbe61799329db5c71f474837892f309008
Opcode Fuzzy Hash: a70d8ddafe7d5efcacfa2dbaec4913ce7f416626137bf5dbfe0f4c7e2c42964f
Instruction Fuzzy Hash: 6F31D07140210AFFDF1DAF98D904AAD7FB5FF24B14F018169FA429A160D7318AA1CF96

Function 01146075 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0114CCCF

Strings

l, xrefs: 0114CFE7
1002, xrefs: 0114CD25

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: 1002$l
API String ID: 1029625771-3186477223
Opcode ID: 7453615fedb796607e7485e18d48e4f453449d54699e0614e10c79a39d9251ac
Instruction ID: 14b7b90685c4a6e8c1928537d36183ec7d1f6c0c50445c75dfe23b7661c9e25d
Opcode Fuzzy Hash: 7453615fedb796607e7485e18d48e4f453449d54699e0614e10c79a39d9251ac
Instruction Fuzzy Hash: 1C91B5B150524EEFEF91DF24C808BEF3AA9FB09315F400126ED0692A51D7BA4DA48F5D

Function 011491B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,01149144,?,00000000,00000000), ref: 0114926F
GetModuleHandleA.KERNEL32(00000000,?,?,?,01149144,?,00000000,00000000), ref: 0114927D

Strings

.dll, xrefs: 011491E5

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 75a9be778d938dd20437eaecba47d571d0c03aa828abf89f98b711cc1b417d32
Instruction ID: 6e84d8d2044213b619ddc61b7bdbc919842f644d2fb9b05387c8c867abf00996
Opcode Fuzzy Hash: 75a9be778d938dd20437eaecba47d571d0c03aa828abf89f98b711cc1b417d32
Instruction Fuzzy Hash: A411703020060AEBEF3D9F18C80CF5E7EB1BF56B59F004215E502888E0C7B595E4CB95

Function 0114BB0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(013701D4,-11365FEC), ref: 0114BB85
GetFileAttributesA.KERNEL32(00000000,-11365FEC), ref: 0114BB93

Strings

@, xrefs: 0114BB38

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 7c6903730475b7a88b1bc9333e7553725a48e23091d460b5050e175d926ae389
Instruction ID: e6761778d19949f97830f893eba3d40ac0de51e314378d614a29d396130cf5ba
Opcode Fuzzy Hash: 7c6903730475b7a88b1bc9333e7553725a48e23091d460b5050e175d926ae389
Instruction Fuzzy Hash: AF014470508209FBEB3D9F68D908B9C7F70BF10B49F118165E506690E4C7B0D691DB8D

Function 01147B8C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 01147BEE

Strings

\\?\, xrefs: 01147C49

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 1c35c1a81b664ea7fd7107e0b056bfab5aef80c4b741bb7337cb420f4e5daf2a
Instruction ID: 0eeddbf4ea0077b6e5cbf9e138557fecab009fea7009278f99983d299ba7a968
Opcode Fuzzy Hash: 1c35c1a81b664ea7fd7107e0b056bfab5aef80c4b741bb7337cb420f4e5daf2a
Instruction Fuzzy Hash: D0312C3550020BBFEF269F98C808F9EBBBABF04B15F000555F601A50A0D37292A1DB59

Function 0114929B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 011492FF

Strings

.dll, xrefs: 011492BC

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: 08d84798ffe7ea25b7539842b6163036176a816f41ed055c930438a564ff0f75
Instruction ID: 1758eaeba549677ff1ef32f5c21dad84af841d763d080053111a95fe744f1d33
Opcode Fuzzy Hash: 08d84798ffe7ea25b7539842b6163036176a816f41ed055c930438a564ff0f75
Instruction Fuzzy Hash: 61F05EB210420AEFDF199F68C888EAE3BA5FF19B58F418111FE069A195C731C461DBA5

Function 0114BD28 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(013701D4,?,?,-11365FEC,?,?,?,-11365FEC,?), ref: 0114BDDA

Part of subcall function 0114BCDA: IsBadWritePtr.KERNEL32(?,00000004), ref: 0114BCE8

CreateFileA.KERNEL32(?,?,?,-11365FEC,?,?,?,-11365FEC,?), ref: 0114BDFA

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 84f64ca093ed891bdd0cf96dc45962dd86a93a4278a28f0072c661a6c861288d
Instruction ID: a22e7ab457334e468c29bc166f580417a620bcfee77638d3d0c0619c7bd5dd15
Opcode Fuzzy Hash: 84f64ca093ed891bdd0cf96dc45962dd86a93a4278a28f0072c661a6c861288d
Instruction Fuzzy Hash: 78112B7100814AFBDF2A9FA4CC08BED3E72BF15B48F048155FA45290A0D736C5B1EB9A

Function 0114B694 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

GetCurrentProcess.KERNEL32(-11365FEC), ref: 0114B6A1
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0114B707

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: a2a6885f5b25630a931b9656b499cbd02b1506fee149edf524e2995cc2dfb7f3
Instruction ID: 2046056ef0adfe25ef4d6a2542bf0746e4249e76914a5daaa0e442750407142f
Opcode Fuzzy Hash: a2a6885f5b25630a931b9656b499cbd02b1506fee149edf524e2995cc2dfb7f3
Instruction Fuzzy Hash: B001317210404BFB8F26AFA8CC04C9E3F7ABFA8B59B054116F90595050C735C062DBA5

Function 011475D9 Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 011475E8
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: c26272951193ab516366060b68d5081cc710144d26ce9e988b9037024269f58f
Instruction ID: bc4e6adc9cbc8adfffa6e600dacf9253ac74e9679a2fbe50f79bb08e7d549168
Opcode Fuzzy Hash: c26272951193ab516366060b68d5081cc710144d26ce9e988b9037024269f58f
Instruction Fuzzy Hash: FAF0B43110224AEFF725AF58C95879E77B9FF40B1AF10013DD20189490D7751985CBA1

Function 00F6E6CA Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00F6E6CF

Strings

bd{, xrefs: 00F6F5BB

Memory Dump Source

Source File: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: bd{
API String ID: 4275171209-279669348
Opcode ID: 07f1ce9cfc35d77e54b33365d1909ac5a5000621bf80222c69519b251e1043c5
Instruction ID: 6b5305b4140a62d9e6a8c1b356f9e9ab0fcf0351c04375100f6ce00a8a1d2303
Opcode Fuzzy Hash: 07f1ce9cfc35d77e54b33365d1909ac5a5000621bf80222c69519b251e1043c5
Instruction Fuzzy Hash: 3FF0BBF11487059BE7046F74E9C976E77A0EB04321F58023CEA8682A84D6781C44CA17

Function 010F1D4D Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 010F1D4D

Memory Dump Source

Source File: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1e128a3ef809f71ae877d85c59f0af9d4425ea44356eef4e34178bef079e190f
Instruction ID: 7ed015828912c49e0ae8a4fb3d2e990691ea29b09def94ccf2c8dc0c7768db19
Opcode Fuzzy Hash: 1e128a3ef809f71ae877d85c59f0af9d4425ea44356eef4e34178bef079e190f
Instruction Fuzzy Hash: 0B31ABF250C604AFE7027F29DC81AAEFBE6FF84260F16082DE2C183610E6759444CB53

Function 01149D13 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 01149DC8

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b4c47fb9f2535ac2597315f6fb53e3b2e096f7d72368a1942093c67b83e52b13
Instruction ID: 78a7d9e0bae381a0e0cea5aaf1022b6e2e9157e1f94c62681a94921b7f68520a
Opcode Fuzzy Hash: b4c47fb9f2535ac2597315f6fb53e3b2e096f7d72368a1942093c67b83e52b13
Instruction Fuzzy Hash: 6D31C171900209FFEB259F69DC84F9EBBB8FF08B18F108169F615AA1D0C7719542CB14

Function 0114952F Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 011495B1

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f82bd96c324c397e9e1faa602299152a29b38fda4643cd60f958d6dfcde0ff9b
Instruction ID: 14567fab22c7ddd155decae3335992aea4579f138dcca7445626b8fd92ac1bba
Opcode Fuzzy Hash: f82bd96c324c397e9e1faa602299152a29b38fda4643cd60f958d6dfcde0ff9b
Instruction Fuzzy Hash: DD31B671540209BBEB249F68DC45F9A77F8FB09B2CF204255F611AA1D1D371A141CB58

Function 04FE0D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FE0DCD

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 946fda94f0cb064ee61dd506ce6ca46340f73798e6eb1cb9ac677fe7d1b2abf0
Instruction ID: 44951fa486f3c81703b5ebca440719f85bf6831db3a7a5de1b9126babebec9b8
Opcode Fuzzy Hash: 946fda94f0cb064ee61dd506ce6ca46340f73798e6eb1cb9ac677fe7d1b2abf0
Instruction Fuzzy Hash: 46213AB6C012189FCB50DF99D885BDEFBB0EF88710F15821AD908BB244D774A546CBA5

Function 04FE0D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FE0DCD

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 0bbe19c40ed87ce63f26dad3220c745c59855aab7a3cd45bf8c351dbd8c14679
Instruction ID: eccc4b89b3dc9740c56fa9b6a00306c2dfb00ef7112bfd5bd7741a18c0a8ed2e
Opcode Fuzzy Hash: 0bbe19c40ed87ce63f26dad3220c745c59855aab7a3cd45bf8c351dbd8c14679
Instruction Fuzzy Hash: 672115B6C012199FCB50CF9AD884BDEFBF4EB88710F15821AD908BB244DB74A545CBA5

Function 04FE1509 Relevance: 1.6, APIs: 1, Instructions: 56serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FE1580

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 87c362664a02ea0a010b57cf7e42b8f8381c8b77fccb7e7d4c0304ff72cea2c1
Instruction ID: 65c73622080a80f14fe1953fb28c329243d39de058db892b1215e1362cc00963
Opcode Fuzzy Hash: 87c362664a02ea0a010b57cf7e42b8f8381c8b77fccb7e7d4c0304ff72cea2c1
Instruction Fuzzy Hash: 0D2106B59002499FDB10CF9AD584BDEFBF4EB48310F10842AE518A7250D378AA45CFA5

Function 04FE1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FE1580

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: fc636a2459d9fd2c098e0ad7f340e8fe3668c896bcad0ee7f92d1b97ea5036a9
Instruction ID: 89da9ebcfe844eb0d01ddaccccb20a46d780fcd8875ae7430ee25f999db4f32b
Opcode Fuzzy Hash: fc636a2459d9fd2c098e0ad7f340e8fe3668c896bcad0ee7f92d1b97ea5036a9
Instruction Fuzzy Hash: 111103B19003499FDB10CF9AD584BDEFBF4AB48320F10802AE518A3250D378AA45CFA5

Function 0114C860 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11365FEC), ref: 0114C8E7

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentFileSleepThreadView
String ID:
API String ID: 2270672837-0
Opcode ID: 26d9c95880dd8c8801b2cd65baa1897280b23979454c16d614e17b1f583d656c
Instruction ID: 9d95af84a0da0751d29ee4581f80cefbd02db043ea0e505f01b64ea2dcf37b67
Opcode Fuzzy Hash: 26d9c95880dd8c8801b2cd65baa1897280b23979454c16d614e17b1f583d656c
Instruction Fuzzy Hash: 9A11F07610110BFBEF1AAFA8CC08E9E3F66BF69A54B054511FA1255060D736C072EBE5

Function 04FE1301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FE1367

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 097a5e26c348b045034bfb7a60238e38544759a3429f76dc5e7d8c2d4387645c
Instruction ID: 5e28373bbcaa2fb09d2f8b4c04f13ed46bb858942a292935a9051a546b489200
Opcode Fuzzy Hash: 097a5e26c348b045034bfb7a60238e38544759a3429f76dc5e7d8c2d4387645c
Instruction Fuzzy Hash: 041125B1800249CFDB10DFAAD585BEEFBF4EF48720F14842AD558A3640D778A945CFA5

Function 0114C648 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 7ffda0f76b454cd315550fd1970e1ce2fe9f3805933fd943450a2a28b6512a83
Instruction ID: 647a34757efc84ccbcf8acde466259e7dee3143ff51ba6ad7f4e3aa7f54df6e4
Opcode Fuzzy Hash: 7ffda0f76b454cd315550fd1970e1ce2fe9f3805933fd943450a2a28b6512a83
Instruction Fuzzy Hash: BE11A17210210BEBDF1D9FA8C808F9E3FB5AF55B08F01D110F91156160C731E561DBA1

Function 04FE1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FE1367

Memory Dump Source

Source File: 00000000.00000002.2294580291.0000000004FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fe0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: ffaa350082321a13a8ba1fd96abaa0ad893d81ddd049180d49fb245959a1b30f
Instruction ID: 2ef014e26e99a926ce384825f53d251f83d4a14c62e7f5fa634d2ca1dcd73788
Opcode Fuzzy Hash: ffaa350082321a13a8ba1fd96abaa0ad893d81ddd049180d49fb245959a1b30f
Instruction Fuzzy Hash: DD1136B1800249CFDB10CF9AD545BEEFBF4EB48720F14841AD558A3240D378A944CFA5

Function 0114BF2C Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11365FEC,?,?,01149C5B,?,?,00000400,?,00000000,?,00000000), ref: 0114BF98

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: 27e736cd94e2ff3a95bdb970b03a359ad8b5db6773beb0aff38f0bba0321a8a1
Instruction ID: b698941af1994d29b7d866d5a6b9fd8ddf5cba0106a680808188cafce34cd6a2
Opcode Fuzzy Hash: 27e736cd94e2ff3a95bdb970b03a359ad8b5db6773beb0aff38f0bba0321a8a1
Instruction Fuzzy Hash: 96F0FF7210414AFBDF1A6FA8CC08D9E3F66FFA9B48F058121FA0949460C732C571DBA6

Function 00F6E76E Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00F6ECBE

Memory Dump Source

Source File: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1da231caf68a25d4bad47c9f9bc4dd670d91dd9c24d902f40178b515abdcd52b
Instruction ID: 21740dbfadb5f8c6b6f6144cdcc1cdb68d9bbde97dd343c951d5b008d0784dc0
Opcode Fuzzy Hash: 1da231caf68a25d4bad47c9f9bc4dd670d91dd9c24d902f40178b515abdcd52b
Instruction Fuzzy Hash: DD115BBB54C241EFE7106E21ED44B7EBBA5FB58724F24082DE9C6C6241D2324851FA57

Function 011477AA Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 0114780E

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: a4bfcee3ed9590d55984366000cb52023cf26bb03c50989c8c076a79855006dd
Instruction ID: 2db3d3f215ee5579f732936037a9084a4568daf2fce9ea90d5b6d532fefc9f17
Opcode Fuzzy Hash: a4bfcee3ed9590d55984366000cb52023cf26bb03c50989c8c076a79855006dd
Instruction Fuzzy Hash: 7D01FB35A0050AFFDF119FA9DC04EDEBF7AFF48741F001165E505A40A0E7328661DBA5

Function 0114A32D Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

CloseHandle.KERNELBASE(01149CF0,-11365FEC,?,?,01149CF0,?), ref: 0114A36B

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID:
API String ID: 4003616898-0
Opcode ID: e299aef57a563e89622a51f6ca026c4e76ec67ac159d2fca7258bfb56ad442e0
Instruction ID: 0df394f45061e6330a24d75a2edd2b602b1f3227565e96c51136657606cd4698
Opcode Fuzzy Hash: e299aef57a563e89622a51f6ca026c4e76ec67ac159d2fca7258bfb56ad442e0
Instruction Fuzzy Hash: 2DE04FA2244047E7DA187BACE80CD8E3E69AFA5F5D7068232E4028A084DB60C192C2A5

Function 011493F2 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,01147478,?,?), ref: 011493F8

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2628a7fd79d0ad2e003713e08c05796102e44bedb714908e06f29452fd9564b4
Instruction ID: 4bdcf997704bddddfec4f17528cc724f335bdc36757db4805f2ed0b0f25a64e6
Opcode Fuzzy Hash: 2628a7fd79d0ad2e003713e08c05796102e44bedb714908e06f29452fd9564b4
Instruction Fuzzy Hash: 54B0923100410DBBCB41BF65DC0988EBFE9FF6669DB009220B92688460CB72E9A49B94

Non-executed Functions

Function 01173DB9 Relevance: 5.2, Strings: 4, Instructions: 151COMMON

Download Yara Rule

Strings

'>, xrefs: 01173EC6
37~y, xrefs: 01173F36
<!?v, xrefs: 01173E11
|V, xrefs: 01173E53

Memory Dump Source

Source File: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: 37~y$<!?v$'>$|V
API String ID: 0-2228666869
Opcode ID: 4dd7b251d62eff6c3f7aa97d13193f48474195488349e51badd19964addb24b8
Instruction ID: d235def0effe4bb45f162f39245fabef4a0c164f9515a794edde14f567cb588c
Opcode Fuzzy Hash: 4dd7b251d62eff6c3f7aa97d13193f48474195488349e51badd19964addb24b8
Instruction Fuzzy Hash: 48518AB692C210DBD308AE29D88563EF7F4BF94750F1B482ED6E687350EB715840AB53

Function 0114B726 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

GetSystemTime.KERNEL32(?,-11365FEC), ref: 0114B75B
GetFileTime.KERNEL32(?,?,?,?,-11365FEC), ref: 0114B79E

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: 6968c8ac9d37ba0500bb155085d783b965047ad6f28dac9c99efaa914cf10e2e
Instruction ID: ce7516fa6bf82e9b39739fbb3f9071de405facd1ba55c52d95dc0863e59a1918
Opcode Fuzzy Hash: 6968c8ac9d37ba0500bb155085d783b965047ad6f28dac9c99efaa914cf10e2e
Instruction Fuzzy Hash: 22012C32104446EBCF299F69D808C8E3F75FFD6B16B054126F412454A0CB31C462DBA5

Function 0114C5E4 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 0114C62B

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 76f3a1694cd690fe8a6d341c2b7368dc93fe3e502547d7e118c385e91c549d69
Instruction ID: 5c90a3584637304fd60d4dd21ec767f2672f11c746f18c6b03ffebf32f2be389
Opcode Fuzzy Hash: 76f3a1694cd690fe8a6d341c2b7368dc93fe3e502547d7e118c385e91c549d69
Instruction Fuzzy Hash: C1F0D43260120EEFCF05CF94C914A8D7BB1BF59359B14C129AA0596210D771A6A0EF84

Function 010EE0D4 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

}S?, xrefs: 010EE2B7

Memory Dump Source

Source File: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: }S?
API String ID: 0-1351014879
Opcode ID: 3d167b743a69d35341a76e9e3c9c08ca0ed30adc7ba88d950a6088f62665056d
Instruction ID: 1365ec20fd8a6087d349f28646e78383057daf536737ad73cdeac75fa5a68266
Opcode Fuzzy Hash: 3d167b743a69d35341a76e9e3c9c08ca0ed30adc7ba88d950a6088f62665056d
Instruction Fuzzy Hash: 777117F3A086009FE3046E19EC8667EFBE5EFD8320F16892DE6C583744E63558158793

Function 010EE153 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

}S?, xrefs: 010EE2B7

Memory Dump Source

Source File: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID: }S?
API String ID: 0-1351014879
Opcode ID: 67d62ece79f4870914156eef32cecc01c3d644a4a26d4a18ffcf86146fc58083
Instruction ID: a9a9fc2deebc8087e23154ff40701b5cd04a8fef849368f8e78dc5f492f5cf56
Opcode Fuzzy Hash: 67d62ece79f4870914156eef32cecc01c3d644a4a26d4a18ffcf86146fc58083
Instruction Fuzzy Hash: C05105F3A086109FD3086E29ED4267EFBE5EFD8720F16892DE6C583744E63558048793

Function 01179C79 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9143879184ad264d1d253e86e719b5f4dfe12ca61fff37ad16f88420239b6a3d
Instruction ID: 874b39421ba051b5a32074de3090245f9bee0e70123d4fec6812ae0265464122
Opcode Fuzzy Hash: 9143879184ad264d1d253e86e719b5f4dfe12ca61fff37ad16f88420239b6a3d
Instruction Fuzzy Hash: AD41C4B35082049FE310BE29EC857AAF7EAEFD4324F1A093DD6C4C3604E67554458A96

Function 01142CBD Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7834503d3e56f7c2854760573af968350d6a2fa2bf3238dc131caf2e0b1d640a
Instruction ID: 65d798e8171801550973ff250248915b6732be6806c6169778d5609587c75a74
Opcode Fuzzy Hash: 7834503d3e56f7c2854760573af968350d6a2fa2bf3238dc131caf2e0b1d640a
Instruction Fuzzy Hash: 5E21A0B251C7049FE355BF68D8867BABBE5EF58310F064D2DE2D4C2650EB35A4408B8B

Function 0114AC5C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 011475D9: GetCurrentThreadId.KERNEL32 ref: 011475E8
Part of subcall function 011475D9: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 0114762B

Part of subcall function 0114BCDA: IsBadWritePtr.KERNEL32(?,00000004), ref: 0114BCE8

wsprintfA.USER32 ref: 0114ACA2
LoadImageA.USER32(?,?,?,?,?,?), ref: 0114AD66

Strings

%8x, xrefs: 0114AD30, 0114AD63
%8x, xrefs: 0114AC9D, 0114ACA0

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: 66e8fb7be4efcf175721c585b95dd3502486bb7dc56007d2eee4e8578b949cc6
Instruction ID: 11d23f0ce4b65b3a73cb1237c5d085e276d6515c3dccdd9cb1f978ba4c131ec4
Opcode Fuzzy Hash: 66e8fb7be4efcf175721c585b95dd3502486bb7dc56007d2eee4e8578b949cc6
Instruction Fuzzy Hash: 9B31353194010ABBDB159F94DD08EEEBBB9FF98711F008125FA12A61A0C7309A61DBA4

Function 0114B82D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(013701D4,00004020,00000000,-11365FEC), ref: 0114B91A

Strings

@, xrefs: 0114B859

Memory Dump Source

Source File: 00000000.00000002.2292215677.0000000001141000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.2291698851.0000000000F60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291722310.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291740783.0000000000F66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291761580.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291784070.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291944916.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291963445.00000000010D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2291987547.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292027932.0000000001103000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292045611.0000000001105000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292066782.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292085155.0000000001117000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292107969.0000000001126000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292124817.0000000001127000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292144026.000000000112A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292164266.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292181435.000000000112D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292235070.000000000114D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292254253.000000000114F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292272365.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292294021.0000000001154000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292321084.0000000001169000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292338674.000000000116A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292355829.0000000001171000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292373256.0000000001174000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292397121.0000000001175000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292417172.000000000117C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292433434.000000000117D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292449251.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292467923.0000000001189000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292491007.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292512356.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292530070.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292554032.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292572888.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292590519.00000000011A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292607002.00000000011AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292636430.00000000011BB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292663870.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292690831.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292708573.00000000011C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292745387.00000000011FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292766873.00000000011FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292789981.0000000001211000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2292829287.0000000001220000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: c6981f92a2c7ddc4827774f68380f74fd6a09329bca2a27344e871d5badbe03e
Instruction ID: 6c3f24dc4fd5bb89a500a002b84e5d37adb662544249dc32a258139eed8a6bb6
Opcode Fuzzy Hash: c6981f92a2c7ddc4827774f68380f74fd6a09329bca2a27344e871d5badbe03e
Instruction Fuzzy Hash: BE318DB550830AEFEB298F48C844B9EBFB0FF08704F009519E95667290D370E6A5CF94

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 5088, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 5088, Parent PID: 4004COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 010F1EC3 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Function 01148CAC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 01146075 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185
libraryCOMMON

Function 011491B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 0114BB0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 01147B8C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 0114929B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 0114BD28 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 0114B694 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 011475D9 Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 00F6E6CA Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33
memoryCOMMON

Function 010F1D4D Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Function 01149D13 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 0114952F Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 04FE0D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON