Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558837
MD5:	33ae691f52ac46353b3f7cdf1d8916fd
SHA1:	004b8b32d043a62ce416abba571f9847b580b152
SHA256:	f307bfc3d6f4e710338171629d9f690706887190750f0fd3845f8e56c49a2abe
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2704 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 33AE691F52AC46353B3F7CDF1D8916FD)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B29F2 CryptVerifySignatureA,

0_2_003B29F2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2112670118.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350	0_2_00354350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00351000	0_2_00351000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354357	0_2_00354357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00353742	0_2_00353742
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00448A04	0_2_00448A04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354B63	0_2_00354B63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354B85	0_2_00354B85

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003AD9E7 appears 35 times

Source: file.exe, 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: XRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeVU

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2763264 > 1048576

Source: file.exe

Static PE information: Raw size of xtrzpeby is bigger than: 0x100000 < 0x29ca00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W;xtrzpeby:EW;yovmqlsh:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2a2be4 should be: 0x2ae69b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: xtrzpeby
Source: file.exe	Static PE information: section name: yovmqlsh
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003611B7 push 253FEEF2h; mov dword ptr [esp], ecx	0_2_0036259B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003611B7 push ebp; mov dword ptr [esp], esi	0_2_003625A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003611B7 push ebp; mov dword ptr [esp], edi	0_2_003625AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003611B7 push eax; mov dword ptr [esp], ebp	0_2_00362A81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003611B7 push esi; mov dword ptr [esp], 7FB68217h	0_2_00363E3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354219 push ebx; mov dword ptr [esp], ebp	0_2_00354244
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354219 push 4723430Ch; mov dword ptr [esp], edx	0_2_00354275
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354219 push edx; mov dword ptr [esp], 067B8A3Bh	0_2_003542AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350 push ecx; mov dword ptr [esp], edx	0_2_003543A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350 push ebp; mov dword ptr [esp], 75FD8B31h	0_2_003543CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350 push edi; mov dword ptr [esp], 7FFEB971h	0_2_0035440D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350 push 7B42F830h; mov dword ptr [esp], edi	0_2_0035445C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00354350 push esi; mov dword ptr [esp], ecx	0_2_0035447D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE84D push eax; mov dword ptr [esp], ecx	0_2_001DFB57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE84D push eax; mov dword ptr [esp], edx	0_2_001DFB5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE8EC push 58B864AAh; mov dword ptr [esp], eax	0_2_001DE902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00361CA5 push eax; mov dword ptr [esp], 306A78F4h	0_2_00362B55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00361CA5 push 27D28F99h; mov dword ptr [esp], esi	0_2_00362B64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00362030 push 5A064DDDh; mov dword ptr [esp], edx	0_2_0036204D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DB033 push eax; mov dword ptr [esp], ecx	0_2_003DB068
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00361026 push ecx; mov dword ptr [esp], eax	0_2_00364055
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00355011 push edx; mov dword ptr [esp], ebp	0_2_003550AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00355011 push edx; mov dword ptr [esp], ebp	0_2_00355155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00362013 push 6B77EC8Ah; mov dword ptr [esp], ebp	0_2_0036550C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036101C push eax; mov dword ptr [esp], esi	0_2_003617D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0036101C push 787FBA37h; mov dword ptr [esp], esi	0_2_00361BDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00367005 push 6C30D870h; mov dword ptr [esp], eax	0_2_00367014
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DD028 push edx; mov dword ptr [esp], ecx	0_2_001DD297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00351000 push ecx; mov dword ptr [esp], eax	0_2_00351007
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00351000 push 3CD42941h; mov dword ptr [esp], edi	0_2_00351041
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00351000 push ebx; mov dword ptr [esp], eax	0_2_00351105

Source: file.exe

Static PE information: section name: entropy: 7.769970936413303

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1DDF0B second address: 1DDF15 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3AC4E9EFACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1DDEFE second address: 1DDF0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3578FF second address: 357903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357C56 second address: 357C68 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3AC4B612C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F3AC4B612C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357C68 second address: 357CBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d add edx, dword ptr [ebp+122D2B61h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F3AC4E9EFA8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push edi 0x00000030 mov edx, dword ptr [ebp+122D3CD5h] 0x00000036 pop edi 0x00000037 call 00007F3AC4E9EFA9h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357CBD second address: 357CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357CC1 second address: 357CCB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357CCB second address: 357CE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F3AC4B612CDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357CE6 second address: 357CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357CEB second address: 357D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F3AC4B612C6h 0x00000009 jmp 00007F3AC4B612CBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357D0A second address: 357D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357DC2 second address: 357E12 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3AC4B612CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 2AAD4122h 0x00000011 push esi 0x00000012 pushad 0x00000013 call 00007F3AC4B612CEh 0x00000018 pop esi 0x00000019 mov ah, bl 0x0000001b popad 0x0000001c pop edx 0x0000001d lea ebx, dword ptr [ebp+1244D7F3h] 0x00000023 jmp 00007F3AC4B612D7h 0x00000028 cmc 0x00000029 xchg eax, ebx 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357E12 second address: 357E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357E16 second address: 357E24 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357E24 second address: 357E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 376F5B second address: 376F67 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AC4B612CEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37720B second address: 377215 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3AC4E9EFACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377395 second address: 3773AB instructions: 0x00000000 rdtsc 0x00000002 je 00007F3AC4B612CEh 0x00000008 jo 00007F3AC4B612C6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3773AB second address: 3773B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377527 second address: 377533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377533 second address: 37755B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3AC4E9EFB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3776AC second address: 3776BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3776BA second address: 3776BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3776BF second address: 3776DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3AC4B612D7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3779A6 second address: 3779AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3779AB second address: 3779D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3AC4B612D6h 0x00000008 pop eax 0x00000009 push edi 0x0000000a jnc 00007F3AC4B612C6h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F3AC4B612C8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BE4B second address: 36BE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BE53 second address: 36BE60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F3AC4B612C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BE60 second address: 36BE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BE64 second address: 36BE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3AC4B612C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push ecx 0x0000000e pushad 0x0000000f jmp 00007F3AC4B612D0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36BE85 second address: 36BE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377B5A second address: 377B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377B5F second address: 377B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F3AC4E9EFA6h 0x0000000b js 00007F3AC4E9EFA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377B72 second address: 377B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jg 00007F3AC4B612D2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 377B82 second address: 377BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3AC4E9EFA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AC4E9EFB8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3785B7 second address: 3785C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3AC4B612C6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3785C6 second address: 3785CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3785CC second address: 3785D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3785D0 second address: 3785E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3AC4E9EFAEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3785E0 second address: 3785EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007F3AC4B612C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37891E second address: 378922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37AD7F second address: 37AD83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 380708 second address: 38070F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3808C0 second address: 3808CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3808CC second address: 3808D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3808D7 second address: 3808ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jbe 00007F3AC4B612C8h 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3808ED second address: 380918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F3AC4E9EFB1h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jng 00007F3AC4E9EFB2h 0x00000017 jo 00007F3AC4E9EFACh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384CFC second address: 384D1E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3AC4B612C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F3AC4B612D3h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384D1E second address: 384D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d jl 00007F3AC4E9EFACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34924E second address: 349268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3841D6 second address: 384201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F3AC4E9EFA8h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384352 second address: 384364 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jno 00007F3AC4B612C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384364 second address: 38436A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38436A second address: 384378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F3AC4B612CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3844D5 second address: 3844E1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AC4E9EFAEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3844E1 second address: 3844E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384B83 second address: 384BC7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3AC4E9EFBDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007F3AC4E9EFB5h 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F3AC4E9EFADh 0x00000018 jmp 00007F3AC4E9EFAAh 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 386587 second address: 3865A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4B612D5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3865A2 second address: 3865C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F3AC4E9EFB3h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3865C2 second address: 3865C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388B96 second address: 388B9B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388C1A second address: 388C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3AC4B612C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388C25 second address: 388C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388C2C second address: 388C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 5D9BC233h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F3AC4B612C8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 push 4E0BCBCBh 0x0000002d push eax 0x0000002e push edx 0x0000002f jp 00007F3AC4B612D0h 0x00000035 jmp 00007F3AC4B612CAh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388EC8 second address: 388ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388FB4 second address: 388FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388FB8 second address: 388FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388FBC second address: 388FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388FC2 second address: 388FCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F3AC4E9EFA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389331 second address: 38933B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3AC4B612C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38933B second address: 389345 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3AC4E9EFACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389956 second address: 389972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4B612D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389A32 second address: 389A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4E9EFB9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 389C60 second address: 389C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A391 second address: 38A410 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop edx 0x0000000e popad 0x0000000f nop 0x00000010 xor edi, 5C70012Ch 0x00000016 jmp 00007F3AC4E9EFB4h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F3AC4E9EFA8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov si, 8574h 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F3AC4E9EFA8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 movsx edi, cx 0x0000005a xchg eax, ebx 0x0000005b push edx 0x0000005c push esi 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A410 second address: 38A41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A41F second address: 38A425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38A425 second address: 38A429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C897 second address: 38C90B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AC4E9EFACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D25A7h], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F3AC4E9EFA8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+1246B05Ch] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F3AC4E9EFA8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f jmp 00007F3AC4E9EFABh 0x00000054 xchg eax, ebx 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38C90B second address: 38C90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D4B1 second address: 38D4CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4E9EFB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38D4CD second address: 38D557 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c or esi, 4AE4BB4Bh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F3AC4B612C8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F3AC4B612C8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov esi, dword ptr [ebp+122D3AF1h] 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jnl 00007F3AC4B612DCh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38DF24 second address: 38DF2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F3AC4E9EFA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38DF2F second address: 38DFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F3AC4B612C8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jmp 00007F3AC4B612D1h 0x00000029 mov di, ax 0x0000002c push 00000000h 0x0000002e pushad 0x0000002f push ecx 0x00000030 mov si, B370h 0x00000034 pop edi 0x00000035 mov ecx, ebx 0x00000037 popad 0x00000038 push 00000000h 0x0000003a jmp 00007F3AC4B612CCh 0x0000003f xchg eax, ebx 0x00000040 jmp 00007F3AC4B612CFh 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F3AC4B612CFh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F4EA second address: 38F541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3AC4E9EFA6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 nop 0x00000013 mov esi, 725F7671h 0x00000018 push 00000000h 0x0000001a mov edi, eax 0x0000001c mov esi, dword ptr [ebp+122D3D91h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F3AC4E9EFA8h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e and esi, dword ptr [ebp+122D3D9Dh] 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F3AC4E9EFAEh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F251 second address: 38F271 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F271 second address: 38F277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F277 second address: 38F280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38F280 second address: 38F284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39100E second address: 3910AC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3AC4B612D2h 0x00000008 jmp 00007F3AC4B612CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jns 00007F3AC4B612CAh 0x00000016 nop 0x00000017 jmp 00007F3AC4B612CDh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F3AC4B612C8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov ebx, 3ACDE8C1h 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007F3AC4B612C8h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000015h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov dword ptr [ebp+1247852Ah], eax 0x0000005f mov dword ptr [ebp+122D3AB6h], eax 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jng 00007F3AC4B612DCh 0x0000006e jmp 00007F3AC4B612D6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391FEB second address: 391FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edi 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391FF6 second address: 392068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 jmp 00007F3AC4B612D3h 0x0000000c jg 00007F3AC4B612C8h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F3AC4B612C8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F3AC4B612C8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov bl, ch 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391203 second address: 391209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 391209 second address: 39120E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39120E second address: 39126A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dword ptr [ebp+122D1CDDh], esi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 add dword ptr [ebp+122D1CDDh], ecx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 jmp 00007F3AC4E9EFAEh 0x0000002b mov eax, dword ptr [ebp+122D06ADh] 0x00000031 adc edi, 64DDEAF0h 0x00000037 push FFFFFFFFh 0x00000039 jnc 00007F3AC4E9EFACh 0x0000003f nop 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393F7A second address: 393F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393F7E second address: 393F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393F82 second address: 393F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 395EEA second address: 395F80 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3AC4E9EFA8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F3AC4E9EFACh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F3AC4E9EFA8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D28FCh] 0x00000034 push 00000000h 0x00000036 add dword ptr [ebp+122D2B02h], edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F3AC4E9EFA8h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 0000001Ah 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 call 00007F3AC4E9EFB3h 0x0000005d mov edi, 6799C3E3h 0x00000062 pop ebx 0x00000063 sub dword ptr [ebp+122D2B40h], esi 0x00000069 xchg eax, esi 0x0000006a push esi 0x0000006b push eax 0x0000006c push edx 0x0000006d jnc 00007F3AC4E9EFA6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3940D5 second address: 394161 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F3AC4B612C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F3AC4B612CEh 0x00000012 nop 0x00000013 sbb edi, 0B586B15h 0x00000019 push dword ptr fs:[00000000h] 0x00000020 call 00007F3AC4B612D2h 0x00000025 and edi, 0F4C2C2Ch 0x0000002b pop ebx 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 stc 0x00000034 mov dword ptr [ebp+122D2060h], ebx 0x0000003a mov eax, dword ptr [ebp+122D1569h] 0x00000040 pushad 0x00000041 push ecx 0x00000042 jmp 00007F3AC4B612CAh 0x00000047 pop edx 0x00000048 push edx 0x00000049 or dword ptr [ebp+122D2C19h], edi 0x0000004f pop eax 0x00000050 popad 0x00000051 push FFFFFFFFh 0x00000053 movzx edi, dx 0x00000056 jmp 00007F3AC4B612D0h 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e ja 00007F3AC4B612C8h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3951AA second address: 3951AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3951AF second address: 3951B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3AC4B612CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3970EC second address: 3970F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3970F1 second address: 3970F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3960DA second address: 3960E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B5EF second address: 39B5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B5F3 second address: 39B5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3AC4E9EFA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399944 second address: 39994E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39994E second address: 3999CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F3AC4E9EFA8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D318Ah], edx 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov ebx, dword ptr [ebp+122D3E09h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F3AC4E9EFA8h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 pushad 0x00000058 jnp 00007F3AC4E9EFACh 0x0000005e popad 0x0000005f mov eax, dword ptr [ebp+122D05C5h] 0x00000065 push FFFFFFFFh 0x00000067 sub dword ptr [ebp+122D27FFh], ecx 0x0000006d nop 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999CE second address: 3999D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999D2 second address: 3999D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B5FF second address: 39B604 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3999D6 second address: 3999DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39CAB7 second address: 39CB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F3AC4B612D4h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F3AC4B612C8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D1D2Ch], edx 0x00000030 push 00000000h 0x00000032 mov ebx, 3E8AA61Fh 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F3AC4B612C8h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jno 00007F3AC4B612C6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FDA1 second address: 39FDA7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39FDA7 second address: 39FDCC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3AC4B612D5h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F3AC4B612CEh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A0DE6 second address: 3A0E85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b jmp 00007F3AC4E9EFB2h 0x00000010 pop eax 0x00000011 nop 0x00000012 push eax 0x00000013 or dword ptr [ebp+1246BBB3h], esi 0x00000019 pop ebx 0x0000001a push dword ptr fs:[00000000h] 0x00000021 call 00007F3AC4E9EFB8h 0x00000026 pop edi 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov bx, 8C29h 0x00000032 mov eax, dword ptr [ebp+122D06A5h] 0x00000038 add bl, 00000058h 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F3AC4E9EFA8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 mov dword ptr [ebp+1246056Ah], edi 0x0000005d mov di, 1200h 0x00000061 nop 0x00000062 push ecx 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A0E85 second address: 3A0E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3AC4B612D0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB83B second address: 3AB84B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3AC4E9EFA6h 0x00000008 jnc 00007F3AC4E9EFA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB84B second address: 3AB850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB850 second address: 3AB863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4E9EFADh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AAFA8 second address: 3AAFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AAFAE second address: 3AAFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4E9EFAEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AAFC1 second address: 3AAFD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AAFD0 second address: 3AAFD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AAFD4 second address: 3AB00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jne 00007F3AC4B612C6h 0x00000011 popad 0x00000012 jmp 00007F3AC4B612CCh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3AC4B612D9h 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C12CA second address: 3C12DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4E9EFADh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C12DD second address: 3C12E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C084D second address: 3C0862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 ja 00007F3AC4E9EFB2h 0x0000000d jnl 00007F3AC4E9EFA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0D9A second address: 3C0DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push edx 0x00000007 push ebx 0x00000008 jmp 00007F3AC4B612D3h 0x0000000d jmp 00007F3AC4B612CAh 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0DC4 second address: 3C0DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4E9EFB5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0EF6 second address: 3C0F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4B612D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0F0E second address: 3C0F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007F3AC4E9EFA6h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0F1E second address: 3C0F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4B612D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0F34 second address: 3C0F42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3AC4E9EFACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0F42 second address: 3C0F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F3AC4B612CEh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C0F53 second address: 3C0F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3AC4E9EFACh 0x0000000a pushad 0x0000000b jmp 00007F3AC4E9EFACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C10CB second address: 3C10DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4B612D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C10DF second address: 3C10E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C10E3 second address: 3C10FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3AC4B612D1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C10FC second address: 3C1109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F3AC4E9EFA6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C1109 second address: 3C1129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F3AC4B612D2h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C45B2 second address: 3C45D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F3AC4E9EFACh 0x0000000e jmp 00007F3AC4E9EFACh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C45D4 second address: 3C460B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F3AC4B612C6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3AC4B612CDh 0x00000015 pushad 0x00000016 jmp 00007F3AC4B612D7h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C460B second address: 3C4610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CB4 second address: 3C5CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CBA second address: 3C5CC7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CC7 second address: 3C5CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3AC4B612C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CD2 second address: 3C5CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CD8 second address: 3C5CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CC2C0 second address: 3CC2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CAD6F second address: 3CAD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CAD75 second address: 3CAD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CAD7B second address: 3CAD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CAD85 second address: 3CAD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB00D second address: 3CB011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB011 second address: 3CB02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jnp 00007F3AC4E9EFA6h 0x0000000f jbe 00007F3AC4E9EFA6h 0x00000015 pop ecx 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB187 second address: 3CB191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3AC4B612C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB191 second address: 3CB1B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F3AC4E9EFB0h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jnl 00007F3AC4E9EFA6h 0x00000016 popad 0x00000017 push esi 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB2C9 second address: 3CB2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CB2D2 second address: 3CB2D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBA4B second address: 3CBA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBA51 second address: 3CBA55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBA55 second address: 3CBA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F3AC4B612D7h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F3AC4B612D0h 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBD54 second address: 3CBD6C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3AC4E9EFA6h 0x00000008 jmp 00007F3AC4E9EFAEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CBD6C second address: 3CBD77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F3AC4B612C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36CA0F second address: 36CA30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFB7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36CA30 second address: 36CA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D0BB4 second address: 3D0BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D0BB8 second address: 3D0BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c je 00007F3AC4B612C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D0BCC second address: 3D0BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D0D66 second address: 3D0D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007F3AC4B612C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1214 second address: 3D1218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1218 second address: 3D1222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3AC4B612C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1222 second address: 3D123B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D18E6 second address: 3D18F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jp 00007F3AC4B612C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1BF0 second address: 3D1BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1BF6 second address: 3D1BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1BFA second address: 3D1C00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1C00 second address: 3D1C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jng 00007F3AC4B612C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387686 second address: 38768C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387BB4 second address: 387BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F3AC4B612D3h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007F3AC4B612CDh 0x00000016 pop eax 0x00000017 and edx, 7EA4CED9h 0x0000001d push B6A37DAFh 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387BF1 second address: 387BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387BF5 second address: 387C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 387C10 second address: 387C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388751 second address: 388769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388769 second address: 388770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388770 second address: 388801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F3AC4B612C8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push ebx 0x00000023 or ecx, dword ptr [ebp+122D3DA9h] 0x00000029 pop edi 0x0000002a lea eax, dword ptr [ebp+1247D2F8h] 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007F3AC4B612C8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov di, 5854h 0x0000004e nop 0x0000004f jmp 00007F3AC4B612D8h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F3AC4B612D7h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388801 second address: 388840 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AC4E9EFA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, dword ptr [ebp+122D3B55h] 0x00000011 js 00007F3AC4E9EFB3h 0x00000017 jmp 00007F3AC4E9EFADh 0x0000001c lea eax, dword ptr [ebp+1247D2B4h] 0x00000022 mov edx, eax 0x00000024 nop 0x00000025 pushad 0x00000026 je 00007F3AC4E9EFACh 0x0000002c jno 00007F3AC4E9EFA6h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388840 second address: 36CA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4B612D0h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007F3AC4B612D9h 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F3AC4B612C8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e xor dword ptr [ebp+122D26E5h], edx 0x00000034 movsx edx, bx 0x00000037 call dword ptr [ebp+122D31B9h] 0x0000003d jmp 00007F3AC4B612D7h 0x00000042 pushad 0x00000043 push esi 0x00000044 pushad 0x00000045 popad 0x00000046 pop esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jc 00007F3AC4B612C6h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6591 second address: 3D65A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6BB1 second address: 3D6BD5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3AC4B612D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6BD5 second address: 3D6BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F3AC4E9EFA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6BE6 second address: 3D6BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DA1C7 second address: 3DA1D1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DD328 second address: 3DD33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4B612CEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DF6A9 second address: 3DF6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DF6AF second address: 3DF6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DF6B3 second address: 3DF6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DF6B9 second address: 3DF6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DF2B2 second address: 3DF2C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F3AC4E9EFA6h 0x00000009 pop ebx 0x0000000a push edx 0x0000000b jo 00007F3AC4E9EFA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E87E6 second address: 3E87EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8934 second address: 3E893A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E893A second address: 3E8941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8941 second address: 3E895A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3AC4E9EFB2h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C2E second address: 3E8C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C37 second address: 3E8C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C3B second address: 3E8C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D6h 0x00000007 jmp 00007F3AC4B612CFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C64 second address: 3E8C90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3AC4E9EFB9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C90 second address: 3E8C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8C9A second address: 3E8CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3AC4E9EFABh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38819D second address: 3881B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3881B4 second address: 3881B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38824D second address: 388253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 388253 second address: 38829B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov cx, E170h 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F3AC4E9EFA8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+122D3DADh] 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push edi 0x00000038 pop edi 0x00000039 jnp 00007F3AC4E9EFA6h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8E2F second address: 3E8E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8E48 second address: 3E8E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3AC4E9EFA6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EDB53 second address: 3EDB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EDB5A second address: 3EDB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4E9EFB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EDB72 second address: 3EDB8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F3AC4B612D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ECFB9 second address: 3ECFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ECFBD second address: 3ECFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3AC4B612D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ECFDA second address: 3ECFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED13A second address: 3ED154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3AC4B612CCh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F3AC4B612C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED278 second address: 3ED27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED27D second address: 3ED29A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D8h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED3EB second address: 3ED3EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED3EF second address: 3ED3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED3F5 second address: 3ED3FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED3FB second address: 3ED3FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED3FF second address: 3ED405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED405 second address: 3ED415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007F3AC4B612C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED415 second address: 3ED452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFAEh 0x00000007 jmp 00007F3AC4E9EFB9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F3AC4E9EFC7h 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F3AC4E9EFA6h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED5F7 second address: 3ED5FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED5FD second address: 3ED607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3AC4E9EFA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ED607 second address: 3ED61F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AC4B612C6h 0x00000008 ja 00007F3AC4B612C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F3AC4B612D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F73EF second address: 3F73F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F73F3 second address: 3F73F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F73F9 second address: 3F740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007F3AC4E9EFA6h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F740D second address: 3F7411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F7411 second address: 3F7431 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007F3AC4E9EFA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F3AC4E9EFAFh 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F7431 second address: 3F743B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F5A8F second address: 3F5A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F658E second address: 3F65AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F3AC4B612C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6890 second address: 3F6894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6894 second address: 3F689E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F689E second address: 3F68A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6E58 second address: 3F6E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F6E5C second address: 3F6E7F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F3AC4E9EFA6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AC4E9EFB7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FBE5A second address: 3FBE63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4013EB second address: 4013F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4013F1 second address: 4013F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34439A second address: 3443AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4E9EFABh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3443AB second address: 3443B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3443B1 second address: 3443C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jo 00007F3AC4E9EFBEh 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3443C4 second address: 3443CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400A89 second address: 400AA7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F3AC4E9EFB1h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400AA7 second address: 400AAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400C2A second address: 400C3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3AC4E9EFAAh 0x00000008 jc 00007F3AC4E9EFA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400D97 second address: 400D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F38 second address: 400F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F3C second address: 400F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F42 second address: 400F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 400F4B second address: 400F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407686 second address: 4076B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4E9EFB9h 0x00000009 jmp 00007F3AC4E9EFB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407955 second address: 40796F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407E7C second address: 407E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3AC4E9EFA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407E86 second address: 407E96 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jne 00007F3AC4B612C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407E96 second address: 407E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407E9A second address: 407EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408DE7 second address: 408DF5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3AC4E9EFA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408DF5 second address: 408DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408DFD second address: 408E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408E05 second address: 408E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3AC4B612C6h 0x0000000a jnc 00007F3AC4B612C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41AAD1 second address: 41AAE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jno 00007F3AC4E9EFA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EEDC second address: 41EEFA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3AC4B612D3h 0x00000008 jmp 00007F3AC4B612CBh 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EEFA second address: 41EF04 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AC4E9EFA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EF04 second address: 41EF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EBEB second address: 41EBEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41EBEF second address: 41EC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F3AC4B612C6h 0x0000000d jnp 00007F3AC4B612C6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421485 second address: 421489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421489 second address: 4214AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612CEh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F3AC4B612C6h 0x00000016 ja 00007F3AC4B612C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4214AE second address: 4214C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4214C4 second address: 4214DF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AC4B612C8h 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b ja 00007F3AC4B612C6h 0x00000011 js 00007F3AC4B612C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42166C second address: 421671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 428026 second address: 42802B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426CA8 second address: 426CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426CAC second address: 426CB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F3AC4B612C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 426CB8 second address: 426CDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jne 00007F3AC4E9EFA6h 0x0000000d popad 0x0000000e push edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jnc 00007F3AC4E9EFA6h 0x00000017 pop edi 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jg 00007F3AC4E9EFB2h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43290F second address: 432915 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432915 second address: 43291B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43291B second address: 432965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 jmp 00007F3AC4B612D8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F3AC4B612D7h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432784 second address: 43278C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43278C second address: 4327AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F3AC4B612CCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438FE7 second address: 439014 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F3AC4E9EFBBh 0x0000000f jmp 00007F3AC4E9EFB5h 0x00000014 pushad 0x00000015 ja 00007F3AC4E9EFA6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 439014 second address: 43901A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43901A second address: 439023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 439023 second address: 439027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4378C7 second address: 4378E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AC4E9EFB8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4378E4 second address: 4378EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4378EB second address: 4378F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 jnl 00007F3AC4E9EFA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437A2B second address: 437A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 jl 00007F3AC4B612C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437A3B second address: 437A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007F3AC4E9EFB5h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F3AC4E9EFADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D155 second address: 43D15F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D15F second address: 43D16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43D2B2 second address: 43D2D8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3AC4B612CAh 0x00000008 jl 00007F3AC4B612DEh 0x0000000e jmp 00007F3AC4B612D2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449CA7 second address: 449CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449CAB second address: 449CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E285 second address: 45E290 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F3AC4E9EFA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E290 second address: 45E2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F3AC4B612D9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E2B6 second address: 45E2BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E2BA second address: 45E2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3AC4B612D7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45E709 second address: 45E70D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463744 second address: 46375D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AC4B612D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46375D second address: 463774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4E9EFAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463147 second address: 46314B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46314B second address: 463153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463153 second address: 463189 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3AC4B612C8h 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F3AC4B612CEh 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnp 00007F3AC4B612D2h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46880F second address: 468813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468813 second address: 46882D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BE18 second address: 46BE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D96F second address: 46D994 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AC4B612D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F3AC4B612CEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46344B second address: 463451 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463451 second address: 463470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3AC4B612D5h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463470 second address: 463474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463474 second address: 463488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F3AC4B612C6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463488 second address: 4634A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3AC4E9EFAEh 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464664 second address: 46469B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3AC4B612C6h 0x0000000a popad 0x0000000b jmp 00007F3AC4B612CBh 0x00000010 jnp 00007F3AC4B612C8h 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F3AC4B612D1h 0x0000001f jg 00007F3AC4B612C6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38BBC3 second address: 38BBC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1DDF51 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1DB4FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1DDEA1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3876EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 415C7B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6D60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00357B96 rdtsc

0_2_00357B96

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 3652

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B7AD1 GetSystemInfo,VirtualAlloc,

0_2_003B7AD1

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00357B96 rdtsc

0_2_00357B96

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001DB7DA LdrInitializeThunk,

0_2_001DB7DA

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003B1B34 GetSystemTime,GetFileTime,

0_2_003B1B34

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558837
Start date and time:	2024-11-19 21:02:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.439560507282752
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'763'264 bytes
MD5:	33ae691f52ac46353b3f7cdf1d8916fd
SHA1:	004b8b32d043a62ce416abba571f9847b580b152
SHA256:	f307bfc3d6f4e710338171629d9f690706887190750f0fd3845f8e56c49a2abe
SHA512:	96aee398ec59ede95408beb3e0a8737073a6d4c168a912eec5138b233aa28eb577e16fbef956ce67c561b0039b617d17e1822a3933c5eec5f06ceeefdde62314
SSDEEP:	49152:LTQKdPvdNDzIe29CmU3UQZ71bWRD+SAqjXgJ9:PQKdXdNDzIe29CmeFpFSPjwJ9
TLSH:	39D55A92B80572CFE8CF27B89427CD86AD6D07BA4B2448C7D86D64BA7D63CC115B7C24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..............................+*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3AC4CD1B0Ah
invd
sub al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3AC4CD3B05h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	c0304d49884df70af722bf3b87e37b95	False	0.9312065972222222	data	7.769970936413303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xtrzpeby	0xa000	0x29e000	0x29ca00	d634d396dc8b80c1d852936ae9dc850a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yovmqlsh	0x2a8000	0x2000	0x400	6fcaf067522544337485f8719b5044a6	False	0.7275390625	data	5.838013533410285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2aa000	0x4000	0x2200	e8508873d88147ea4597a12984b5d7d3	False	0.07456341911764706	DOS executable (COM)	0.9308905923901474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	15:02:58
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1d0000
File size:	2'763'264 bytes
MD5 hash:	33AE691F52AC46353B3F7CDF1D8916FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	3.2%
Signature Coverage:	4.5%
Total number of Nodes:	378
Total number of Limit Nodes:	25

Executed Functions

Function 00357B96 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,D9CC1CA4,00000003), ref: 00357C09

Strings

C, xrefs: 00357ED7

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 23d51732ba2efadc04068603660a3773031e98c0461cb9f5ccdf68af0322a930
Instruction ID: 1a58cf27db95e3d258e3f434c5154b75e09182ca251d9242b5834dbe98d52e63
Opcode Fuzzy Hash: 23d51732ba2efadc04068603660a3773031e98c0461cb9f5ccdf68af0322a930
Instruction Fuzzy Hash: 9C21387210C209AEDB02DF65E951EBF3BA9DF80322F30845AEC42C3960C2711D54CB29

Function 003B7AD1 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-120F5FEC), ref: 003B7ADD
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 003B7B3E

Memory Dump Source

Source File: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: f93e4f27444d9628a31f5a922b5bf9ea613152d28f53f02df4a7d9a1edc8d8e4
Instruction ID: 8ceb53bb3fa8eb963fc1ea464dd70f7d3bebdc46154726fb856299b20a72f03b
Opcode Fuzzy Hash: f93e4f27444d9628a31f5a922b5bf9ea613152d28f53f02df4a7d9a1edc8d8e4
Instruction Fuzzy Hash: 1841F4B1A44206EFE329CF60CC45B96BBACFF48744F1004A6A347DDD92D67595E48BA0

Function 00354350 Relevance: 1.6, APIs: 1, Instructions: 107libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00354350

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b640b0c4baab78fc1adcb9c2d45a2b278f418e23e0b685907f6c7936872d8073
Instruction ID: 0add735e74f3208ee7f4d6f94dbe2b0db42c4f3995ead5b27a370d2dfa83cefb
Opcode Fuzzy Hash: b640b0c4baab78fc1adcb9c2d45a2b278f418e23e0b685907f6c7936872d8073
Instruction Fuzzy Hash: F44165B250D200EFD309AF29D8425AEFBF9FF99350F16482EE6D682610C3344881CB97

Function 001DB7DA Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 001DB94A

Memory Dump Source

Source File: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 4f4b5987744ab379335d5ff0d4ae72ee5d297fc5004b533236c8103fca1b9ca6
Instruction ID: e1f129a611076a5051e8f0c2873536c34324e3fbd6e08f5ede0536ed4327e473
Opcode Fuzzy Hash: 4f4b5987744ab379335d5ff0d4ae72ee5d297fc5004b533236c8103fca1b9ca6
Instruction Fuzzy Hash: 20E0C2B110C5C9CEDF2ADF7089427A9360EEB50B04F920617FB438AF4ACB2D0D11879A

Function 003AF0BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 003AF1CB
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 003AF1DF

Strings

1002, xrefs: 003AF195
.exe, xrefs: 003AF126
.dll, xrefs: 003AF102

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: f2022bc735022118b2b1860d4be79f080b818e29e538571d5f3674c070380bd7
Instruction ID: a145b0cf55edb44e83625d5982c9724f229163dce71fae83277f61bb83525477
Opcode Fuzzy Hash: f2022bc735022118b2b1860d4be79f080b818e29e538571d5f3674c070380bd7
Instruction Fuzzy Hash: A231A031804206FFCF27EF90D909AAE7B79FF0A354F104179F9029A561DB3199A0DB91

Function 003B84FD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.exe, xrefs: 003B8628, 003B866E, 003B8639, 003B864C
.exe, xrefs: 003B8663

Memory Dump Source

Source File: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: .exe$.exe
API String ID: 0-1392631246
Opcode ID: 467d985dceed4c4708a9cb2c0b88115a8a5bc46681a086f6f97dd078deef6faa
Instruction ID: fc9407e9efd4e3069049b6348d387b55c8cdcb470c7ac066b34a00ddfed5c027
Opcode Fuzzy Hash: 467d985dceed4c4708a9cb2c0b88115a8a5bc46681a086f6f97dd078deef6faa
Instruction Fuzzy Hash: 51418E71900205EFDB32DF14C944BEA77B8FF00318F164456EB12AB952DB70AC90DB61

Function 003AF5C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,003AF552,?,00000000,00000000), ref: 003AF67D
GetModuleHandleA.KERNEL32(00000000,?,?,?,003AF552,?,00000000,00000000), ref: 003AF68B

Strings

.dll, xrefs: 003AF5F3

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: d1afb7492383a41b7d502eb3e6facf9772dfebb5973e9fdb2cce11b72c4395b0
Instruction ID: 92173008a30af597ba84e60c4edaa1bbfadd7d6e52586d4e6b865899d00b13d8
Opcode Fuzzy Hash: d1afb7492383a41b7d502eb3e6facf9772dfebb5973e9fdb2cce11b72c4395b0
Instruction Fuzzy Hash: BE113C3010160AFEDB37EFA4C949B9EBB74FF02345F154235A802888B1DBB599E0DE95

Function 003B1F1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00EF0324,-120F5FEC), ref: 003B1F93
GetFileAttributesA.KERNEL32(00000000,-120F5FEC), ref: 003B1FA1

Strings

@, xrefs: 003B1F46

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 91cadc344face9cc35525fd2ad26d0a64547ebfaf1b670a1681e16b280a2a506
Instruction ID: 93c4c61df0ad9aa80e4db1b49bfb5bbe68003bb9a73fd338c2dadad662e80cbb
Opcode Fuzzy Hash: 91cadc344face9cc35525fd2ad26d0a64547ebfaf1b670a1681e16b280a2a506
Instruction Fuzzy Hash: 64018171508205FAEB23DF64C819BFC7E74EF01348FA48225E60369C90D7B49B91EB00

Function 003611B7 Relevance: 4.6, APIs: 3, Instructions: 133
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00363677
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0036369E
GetNativeSystemInfo.KERNELBASE(?), ref: 003636F5

Memory Dump Source

Source File: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 90eef1cbe939094e311369fee0c3e7ee2fb35c561321ffa1b2926e8d5e76396e
Instruction ID: 804b8a2610406ac475863096bb8da4691c9685a774c3a72b2ea510547cb5990e
Opcode Fuzzy Hash: 90eef1cbe939094e311369fee0c3e7ee2fb35c561321ffa1b2926e8d5e76396e
Instruction Fuzzy Hash: 9451B5B140860EDFDB12DF24DC446AF77E8FF44310F228929E88286A44DB729DA4DF59

Function 003ADF9A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 003ADFFC

Strings

\\?\, xrefs: 003AE057

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 942f079b21ae73ae764b7f668839084463d7d981b1fe8db6c3f25a7b6971f524
Instruction ID: fc6008bfaced5b0883a8c6312a1210512092ac5c5fd4f4b7e2188f56aa570c27
Opcode Fuzzy Hash: 942f079b21ae73ae764b7f668839084463d7d981b1fe8db6c3f25a7b6971f524
Instruction Fuzzy Hash: 48313C31900209BFDF22EF99CD09F9EBB76FF0A300F000155F901A6461D7B29961DB55

Function 00357E4A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00357E51

Strings

C, xrefs: 00357ED7

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 1709bff2f2027e5d65a796e62ad728770f23c5ca8b2a090b438449484c9a5598
Instruction ID: 8d53af91ede1a71058948083da7dfb362118c9d5a2f94216f7c9f087420ad084
Opcode Fuzzy Hash: 1709bff2f2027e5d65a796e62ad728770f23c5ca8b2a090b438449484c9a5598
Instruction Fuzzy Hash: 0011E17260C24EAEDB02DF64E841EAF7B66EF81322F60815AEC05D3E61C6721C558B58

Function 00357A03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00357A1B

Strings

C, xrefs: 00357ED7

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: fcc4c3dbfa5361a90a033933b5e0ffefbf854e84bf5ead66b4ba86d5f81692cc
Instruction ID: 0d1c8a94e91cd85b5d36e9bf1c2c1515145fee8eb85313310fa13a6e9ec84aa8
Opcode Fuzzy Hash: fcc4c3dbfa5361a90a033933b5e0ffefbf854e84bf5ead66b4ba86d5f81692cc
Instruction Fuzzy Hash: 8701D27150C24E9BDB02DF64D881FAE3BA5EF41322F204159EC0593D61C2B21D558B58

Function 003AF6A9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 003AF70D

Strings

.dll, xrefs: 003AF6CA

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 72702433bf8222ccdd7fba785684e0b4950e3e2a21a2fe8a5af24f944023fb33
Instruction ID: 3b621f21aa326d83fb34c6e85de62b4c9eefc6203008571f0f9947156f575ecc
Opcode Fuzzy Hash: 72702433bf8222ccdd7fba785684e0b4950e3e2a21a2fe8a5af24f944023fb33
Instruction Fuzzy Hash: 0AF03071104205AFDF12DF94D945AAE7BA4FF19340F508125FD074D561D771C461AB51

Function 003B2136 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00EF0324,?,?,-120F5FEC,?,?,?,-120F5FEC,?), ref: 003B21E8

Part of subcall function 003B20E8: IsBadWritePtr.KERNEL32(?,00000004), ref: 003B20F6

CreateFileA.KERNEL32(?,?,?,-120F5FEC,?,?,?,-120F5FEC,?), ref: 003B2208

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 05f8ded46314233569946e8062cc6af0dc4cfa5dc46b0fd48ece8914de5eb666
Instruction ID: 55ed0665332fccf1fef918c6ec7b3525df6e1d7a0454e5b25e63dc839b03ffe6
Opcode Fuzzy Hash: 05f8ded46314233569946e8062cc6af0dc4cfa5dc46b0fd48ece8914de5eb666
Instruction Fuzzy Hash: C411237110014AFBEF139FA8CD09BDE3E72BF09348F148215BB1668860D776C9A2EB51

Function 003B1AA2 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

GetCurrentProcess.KERNEL32(-120F5FEC), ref: 003B1AAF
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 003B1B15

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: b234025021a082309d192944fd2647caa41c60dfa7b9183f4319707fd8fd1df9
Instruction ID: bc547f5ca7442f6dacc2a1cbf86b793281dcb8e5b1b5a837d9e25a5237609353
Opcode Fuzzy Hash: b234025021a082309d192944fd2647caa41c60dfa7b9183f4319707fd8fd1df9
Instruction Fuzzy Hash: 0401E43210010AFA8F23EFA4DC19CDE3B39FFA9354B408115FA0799821DB75D462EBA1

Function 003B7E74 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,v{;,003B7E70,?,?,?,?,?,v{;,?,?,003B7B76), ref: 003B7E94

Strings

v{;, xrefs: 003B7E74

Memory Dump Source

Source File: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: v{;
API String ID: 4275171209-3539829993
Opcode ID: 1e6e5a3494c9a6822083a16eb23d4c7c2e46b3f531e93e9df8c3bbf3b4f8ad26
Instruction ID: 11abe7e1286fbdee299bf4fc39b3392422efb194123c86bbd5dadb38a3e0a3ca
Opcode Fuzzy Hash: 1e6e5a3494c9a6822083a16eb23d4c7c2e46b3f531e93e9df8c3bbf3b4f8ad26
Instruction Fuzzy Hash: B8F0F4B1904209EFD721CF04CD08B9ABBE5FF84311F1184A4F54AAB991D7B08CC0CB50

Function 00354219 Relevance: 1.6, APIs: 1, Instructions: 111libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00354219

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6578946c4244f676de84c163659d52f9ebdbc2d89d82d37c909896d7d7bc5524
Instruction ID: 4dcc6ff52ba9ab525a0db56b396b22690118720347054bd2034c6f54974e1f26
Opcode Fuzzy Hash: 6578946c4244f676de84c163659d52f9ebdbc2d89d82d37c909896d7d7bc5524
Instruction Fuzzy Hash: D43160F250C604AFE7166F49EC81ABEFBE9EF89360F11482DF6C4C2640E63558408B97

Function 003B0121 Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 003B01D6

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4dda36834c386ff92e194568a2dc598914bb4efc1dffaa2801d6b4d2fc9126ff
Instruction ID: a3ed6ebf8f5e406616c5e83a60e62c832bc1e0892254ae676d43512c6cf51aaa
Opcode Fuzzy Hash: 4dda36834c386ff92e194568a2dc598914bb4efc1dffaa2801d6b4d2fc9126ff
Instruction Fuzzy Hash: 36318D71900204BEEB26DFA8DC49F9EBBB8FF44728F208169F615AA591C771A941DB10

Function 003AF93D Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 003AF9BF

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fa7ee5e941c1d0a430a2cd79ff711db1dd2d806f3dc4b78e326eecfbcea7b27a
Instruction ID: 963872f8ad3deba8b2b8c715c4eeacb09ceef49e987eafed95eefbea1c8f1e60
Opcode Fuzzy Hash: fa7ee5e941c1d0a430a2cd79ff711db1dd2d806f3dc4b78e326eecfbcea7b27a
Instruction Fuzzy Hash: C6319171600204BEEB21DFA8DC45F9AB7B8FB05728F208269F615AE1D1D7B1A5428B54

Function 003B824A Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 003B82F7

Memory Dump Source

Source File: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: fbeaf42916b4077569068e931a3f7d247a474c6c5d5733f038b86b5ed1ce34f7
Instruction ID: ab5e243a41429fc4aead661d378a6b525651af6b23cc9a18bc4e2945497b4f75
Opcode Fuzzy Hash: fbeaf42916b4077569068e931a3f7d247a474c6c5d5733f038b86b5ed1ce34f7
Instruction Fuzzy Hash: C5118779E01225DBEB325F04CD44BEA77BCAF14B58F514095A609A6840EF709DC0CBA1

Function 04BE0D41 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BE0DCD

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 521e0b98d901163a95c9624bfae4003cb6570d71643960f01bbe726d5888c933
Instruction ID: 2ccb94cc52bf2ebc61071735a85b46b0ba92f561ca5469de48ab7eef69d56370
Opcode Fuzzy Hash: 521e0b98d901163a95c9624bfae4003cb6570d71643960f01bbe726d5888c933
Instruction Fuzzy Hash: 312134B6C002199FDB50DF9AD884BDEFBF4EF88720F14855AE908AB244D774A540CBA5

Function 04BE0D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BE0DCD

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 891fc54ffb57fe7e2e3651e310c18288d0737008635a9cf86ead38ed99239e1e
Instruction ID: 6b6f634cbb3a2cdcefba8104f5d4ffd9bee87fa1437571eabf63ad54f52d07c1
Opcode Fuzzy Hash: 891fc54ffb57fe7e2e3651e310c18288d0737008635a9cf86ead38ed99239e1e
Instruction Fuzzy Hash: 292113B6C012199FDB50DF9AD884BDEFBF4EB88720F14855AD908AB244D774A540CBA4

Function 04BE1509 Relevance: 1.6, APIs: 1, Instructions: 56serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BE1580

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 74d52559d815fd954dc3004f54162d31df4582681db583f5385f326312096f96
Instruction ID: fd14ac47daf5addc7f5dc42075b81764177eaf275363a09e2385c79a6ddf8bec
Opcode Fuzzy Hash: 74d52559d815fd954dc3004f54162d31df4582681db583f5385f326312096f96
Instruction Fuzzy Hash: 472117B1900249DFDB10CF9AC584BDEFBF4EB88320F10842AE558A7250D378A644CFA5

Function 04BE1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BE1580

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 2f352e29cc2de58d94bf0133f9645f7d163c99698df9fec2fdb84853b930d1b6
Instruction ID: 59b32ddbf7da5f1f1d44ec5f312949bddaa5d5428f892076ce7d2dec56c75a4b
Opcode Fuzzy Hash: 2f352e29cc2de58d94bf0133f9645f7d163c99698df9fec2fdb84853b930d1b6
Instruction Fuzzy Hash: F011E4B1900249DFDB10CF9AC584BDEFBF4EB88324F20842AE559A7250D378A644CFA5

Function 003B2C6E Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-120F5FEC), ref: 003B2CF5

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: 41b3a2e7e799d2992e88d83379e219eb1dd52e5b1299312fb9bdde047099e8fb
Instruction ID: d3e269cd99f317b3ab576502298844f947e67929a65237571636365a2f37cf11
Opcode Fuzzy Hash: 41b3a2e7e799d2992e88d83379e219eb1dd52e5b1299312fb9bdde047099e8fb
Instruction Fuzzy Hash: 8011933210020ABACF179FA4DC09DDF3A6AFF59349B154615FA1259821C736C4B1EB61

Function 003B2A56 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 578f9b454cf27d3e1465a535e1ed2854343f46ac504b98b0e82cbf4fe497f796
Instruction ID: a9859f7523ba4b3cee80eec95434dbbb397160fa1ed1b2fc9eacc8aead575409
Opcode Fuzzy Hash: 578f9b454cf27d3e1465a535e1ed2854343f46ac504b98b0e82cbf4fe497f796
Instruction Fuzzy Hash: B6115B3210420AEACF23EFA4C909EDF3BA9BF45348F118215FA0259861DB35C962EB51

Function 04BE1301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BE1367

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 00ee6b7391a9c64d07a1954585bf9268e2df8ee09819fbd183dcd9063fcab53a
Instruction ID: 5a7a096229af9ebf8ccef024d6b472b520765df8e89127439e83d61bfe6602c0
Opcode Fuzzy Hash: 00ee6b7391a9c64d07a1954585bf9268e2df8ee09819fbd183dcd9063fcab53a
Instruction Fuzzy Hash: B21143B1800209CFEB10CF9AC445BEEFBF8EB88324F20846AD558A3640D378A540CBA5

Function 04BE1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BE1367

Memory Dump Source

Source File: 00000000.00000002.2250318017.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4be0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 2ab3d219dda44f7f6b771053339d6f07c397a0d11c034b671519433aca0d38ad
Instruction ID: cac3e61213035f0f787c5990a55b5e91f9bea3c81b7cfad9471b32d901442046
Opcode Fuzzy Hash: 2ab3d219dda44f7f6b771053339d6f07c397a0d11c034b671519433aca0d38ad
Instruction Fuzzy Hash: 881136B1800249CFDB10CF9AC445BEEFBF8EB48324F20845AD558A3250D778A544CFA5

Function 003B233A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-120F5FEC,?,?,003B0069,?,?,00000400,?,00000000,?,00000000), ref: 003B23A6

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: e7474a920a2d4619d2abdb1043498a573ac35d350a2f9e52e79b85148f0862aa
Instruction ID: 095e5c82f84d48e8909f9071d0447c9cc9381cc7d85eb7f3e5168eda13cb2dd3
Opcode Fuzzy Hash: e7474a920a2d4619d2abdb1043498a573ac35d350a2f9e52e79b85148f0862aa
Instruction Fuzzy Hash: 4FF0B63610410AEBCF139F98C809D9E3B6AFF55344F408221FA0A59821D73AC8A1EB61

Function 00357BBB Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D9CC1CA4,00000003), ref: 00357C09

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6b427de337464ded397b56ef06ad63fae35e8a086c63c1592a077980d7f097f7
Instruction ID: de3d2fdaae57e1e79e5c081db028f28e8595f42dd4d6d8128bef251758dc84b6
Opcode Fuzzy Hash: 6b427de337464ded397b56ef06ad63fae35e8a086c63c1592a077980d7f097f7
Instruction Fuzzy Hash: 5BF0EC7600D1056EEB11DE31A5B5EBF37B8DFC5361F21485AECC2CA491C4241D89C732

Function 00357BD4 Relevance: 1.5, APIs: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D9CC1CA4,00000003), ref: 00357C09

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ad96cce977fd7251b854859b4c13d81cae6ac456c6e837949b6d9fe01052ed02
Instruction ID: 537d965385d435d47d1202c372d00ab0c8efa9adaa96c71d33fc15a62efc0c9f
Opcode Fuzzy Hash: ad96cce977fd7251b854859b4c13d81cae6ac456c6e837949b6d9fe01052ed02
Instruction Fuzzy Hash: 25F0E57604C21A6EF605DE36A965DBF37A8DBC4770F50892AE896CB0C0C9241D89C731

Function 00361CA5 Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00362B4D

Memory Dump Source

Source File: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7fb12aad3fdc6c431e7e30a7ab4a03b3f42cfbdcd137a0e124a014255c286ec2
Instruction ID: a643ab7db22722be179576bdec1d83e0e478ac81df71f374670b3bf1394232d7
Opcode Fuzzy Hash: 7fb12aad3fdc6c431e7e30a7ab4a03b3f42cfbdcd137a0e124a014255c286ec2
Instruction Fuzzy Hash: 2BF0DFB450C745DFC300AF2584C542ABBF8EF08B04F11891DAAC587625C2758891EB17

Function 003ADBB8 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 003ADC1C

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 08299f2031194a90290e7c78f90d8701c17a038ff683f4ab82a73740884a6a6e
Instruction ID: 272fa56c4cc637748bcf735b518ea66476d9ec6b31ea565d4a43824764b40a95
Opcode Fuzzy Hash: 08299f2031194a90290e7c78f90d8701c17a038ff683f4ab82a73740884a6a6e
Instruction Fuzzy Hash: E901E83560011DBFDF129FA4CC45D9EBB7AFF49390F400161F406A8861D7329661EB60

Function 001DE84D Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 001DF6C0

Memory Dump Source

Source File: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 66f01293d0c978132efe7f0dd81cfa318e5a860b3489a4e5df26c4378af65f90
Instruction ID: 74c03e57f605b54a15004fb6a70f76be39f6fafd9a094473f323430910ac1786
Opcode Fuzzy Hash: 66f01293d0c978132efe7f0dd81cfa318e5a860b3489a4e5df26c4378af65f90
Instruction Fuzzy Hash: 02012CB550C604CFE7086F28C44556EBBF5EF84310F26462EA4D787794D7319D52DA43

Function 003B073B Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

CloseHandle.KERNELBASE(003B00FE,-120F5FEC,?,?,003B00FE,?), ref: 003B0779

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: 28e044c0fc575c575aedcb39228001d61790a98ac2aa4c5edde6c39dbf7940c3
Instruction ID: 8de6a3ec89bbaf9d9743629f78b4482ef94c689c06e28a390b3f095be0330628
Opcode Fuzzy Hash: 28e044c0fc575c575aedcb39228001d61790a98ac2aa4c5edde6c39dbf7940c3
Instruction Fuzzy Hash: C7E048A2104642B5CE17AAB9DC4ED8F5B2CEFD1384B004131B1038DC55EE24D492D561

Function 001DE8EC Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 001DE8F1

Memory Dump Source

Source File: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 26aae683ae997786264ce7f2555af0c3cb4a45ddecafa86c3d4734b3e80743bc
Instruction ID: 4ef6cfb2c21e6bd581b2daa401e3adeff5ca52900a78e945729883d9d786a810
Opcode Fuzzy Hash: 26aae683ae997786264ce7f2555af0c3cb4a45ddecafa86c3d4734b3e80743bc
Instruction Fuzzy Hash: C2E0C27510C1089FDF406E24CC4877EB6D8DF80345F660419AA46C7340D2700C018692

Function 003AF800 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,003AD886,?,?), ref: 003AF806

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6a02a8149c03e38a53801e0a92615008056f590d9cd729a400223a9f1b618eb9
Instruction ID: 5476d8ba3e42d5ae6512f1f3ef797c8276f03ae1a09eb33898c3fb4171ea99e3
Opcode Fuzzy Hash: 6a02a8149c03e38a53801e0a92615008056f590d9cd729a400223a9f1b618eb9
Instruction Fuzzy Hash: C6B09231000509BFCB42FF95DC06C4DBF69FF16398B10C120F906480228B72E962EBE4

Non-executed Functions

Function 00351000 Relevance: 4.2, Strings: 3, Instructions: 476COMMON

Download Yara Rule

Strings

|u9K, xrefs: 00351249
?K[, xrefs: 00351531
Qq>U, xrefs: 0035120B

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID: ?K[$Qq>U$|u9K
API String ID: 0-8054802
Opcode ID: 4889b38455e9d608ba905436803dd89cc78c83c45da75d3f298087cf71b1460a
Instruction ID: 1f2e9080a0eef8774c117eda138e055ef1d31faa23932613ceeef07108eff36b
Opcode Fuzzy Hash: 4889b38455e9d608ba905436803dd89cc78c83c45da75d3f298087cf71b1460a
Instruction Fuzzy Hash: 58E1F5F360C2049FE308AF29EC8577ABBE9EF94320F16493DE6C4C7344EA7558458696

Function 003B1B34 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

GetSystemTime.KERNEL32(?,-120F5FEC), ref: 003B1B69
GetFileTime.KERNEL32(?,?,?,?,-120F5FEC), ref: 003B1BAC

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: ba4681e6f4b63b5b33e11c75e3b082d365b73cc1d7840cb3b8c393e3e87842ae
Instruction ID: 40a15cb2d9f7617aab290d52523237e5529fa1095e9fd39b7a60ee0b09f352a8
Opcode Fuzzy Hash: ba4681e6f4b63b5b33e11c75e3b082d365b73cc1d7840cb3b8c393e3e87842ae
Instruction Fuzzy Hash: F001EC3210014AFBCB229F59DC1DD9F7F79FF86754B508222F50249861EB32D861DB61

Function 003B29F2 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 003B2A39

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 2529c1ade4e382df5a0c0456dfcd92243d6cfb89587cf8f461859b581a0185ba
Instruction ID: e19e60f7f6c27be4a37149c7ffcf59ada3e83006ea85caf23e4fb9053aaa418b
Opcode Fuzzy Hash: 2529c1ade4e382df5a0c0456dfcd92243d6cfb89587cf8f461859b581a0185ba
Instruction Fuzzy Hash: E2F0F83260010AEFCF12CF94C904A8D7BB2FF14308B108125FA1596920D775DA71EF40

Function 00353742 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2248994dc836659d5bb1766c08c2109cae5c971d0b6fd181f8d89883ef1a619d
Instruction ID: fa4b651eb02b578917ed3b9965f3143c54a595ec3d7d0cd6ba3b647b4eae0927
Opcode Fuzzy Hash: 2248994dc836659d5bb1766c08c2109cae5c971d0b6fd181f8d89883ef1a619d
Instruction Fuzzy Hash: 3B51DBA250E7CA6FC707CB384878699BFA0AE5710470D86CFD8D54FAA3D315A21AD713

Function 00354357 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a1eede3fd0391f1a898efcdb332fb61673ade5566b52599e2f7ed42f4bad1e
Instruction ID: 0d161090222cf657eeb517a84014f9117912a72f4a4704a5cfab8d082cd79c1c
Opcode Fuzzy Hash: 12a1eede3fd0391f1a898efcdb332fb61673ade5566b52599e2f7ed42f4bad1e
Instruction Fuzzy Hash: 404169B250D210EFD30AAF29D8415AAFBF5FF99310F1A886EE1C687611D3354881CB97

Function 00354B63 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fcec0fc3dbf837548f28ca9e2ec40e50fabdc22a959aef58bdb68e4b06e3e5
Instruction ID: b860327af2d5a47797c9880b6033ee13d7d3dd28d00a595606ae52c074ca33cd
Opcode Fuzzy Hash: 09fcec0fc3dbf837548f28ca9e2ec40e50fabdc22a959aef58bdb68e4b06e3e5
Instruction Fuzzy Hash: 10317EB250C704AFE715BF29E88467AFBE4FF48314F16492DEAD482600D7365984CB97

Function 00354B85 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b24c2a8607fbf2d7d70286ab909b999c3a5c6e3eaf26261311424b54e6b739
Instruction ID: 3d36de14a86dc600455d975894397b8f267db90d6d759b52de1c7145b9d6c7ae
Opcode Fuzzy Hash: 07b24c2a8607fbf2d7d70286ab909b999c3a5c6e3eaf26261311424b54e6b739
Instruction Fuzzy Hash: 35318DB250C704AFE7157F29E8846BAFBE4FF48360F06492DEAC482A00D7355944CB93

Function 00448A04 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62debd93ee29725052442ee944ba2278675bde57b32705c02a0cae4db1f8b4c0
Instruction ID: 472f765d1433b21c1c957659bf8a768984a96348b4a4ec832a9a03eac44fab1c
Opcode Fuzzy Hash: 62debd93ee29725052442ee944ba2278675bde57b32705c02a0cae4db1f8b4c0
Instruction Fuzzy Hash: 47213BB290C5148FE709BE18985003EB7D5BF94350F2A452FD5C6B7604FEB9541297CB

Function 003B106A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 003AD9E7: GetCurrentThreadId.KERNEL32 ref: 003AD9F6

Part of subcall function 003B20E8: IsBadWritePtr.KERNEL32(?,00000004), ref: 003B20F6

wsprintfA.USER32 ref: 003B10B0
LoadImageA.USER32(?,?,?,?,?,?), ref: 003B1174

Strings

%8x, xrefs: 003B113E, 003B1171
%8x, xrefs: 003B10AB, 003B10AE

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: 5e4c4d991123d0034cf011c081fa7a4f89e0abe23bd451cb16cc5791deb6cbed
Instruction ID: fbf8282f1b2a9078134c937733c754a0f9f17e70a6749076dba9718013a59c06
Opcode Fuzzy Hash: 5e4c4d991123d0034cf011c081fa7a4f89e0abe23bd451cb16cc5791deb6cbed
Instruction Fuzzy Hash: 5231387190010AFBCF12DF98DC09EEEBB79FF89310F108125F612A6661D7719A61EB61

Function 003B1C3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00EF0324,00004020,00000000,-120F5FEC), ref: 003B1D28

Strings

@, xrefs: 003B1C67

Memory Dump Source

Source File: 00000000.00000002.2247856911.00000000003A4000.00000040.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.2247385234.00000000001D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247402958.00000000001D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247424748.00000000001D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247442044.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247461120.00000000001E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247476786.00000000001E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247492924.00000000001E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247610527.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247632281.0000000000340000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247662851.000000000035E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247706313.0000000000368000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247726827.0000000000369000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247748911.0000000000372000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247768212.0000000000375000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247790170.0000000000378000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247806820.0000000000379000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247830204.0000000000390000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247878549.00000000003B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247898229.00000000003B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247918548.00000000003C4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247941068.00000000003C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247964551.00000000003CE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247982572.00000000003D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248001773.00000000003DB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248019998.00000000003E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248039785.00000000003E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248058690.00000000003EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248077320.00000000003EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248098400.00000000003EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248115910.00000000003EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248134726.00000000003F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248160230.00000000003F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248180135.00000000003F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248199977.00000000003F8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248220805.00000000003FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248240095.00000000003FF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248258627.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248275714.0000000000402000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248300280.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248320039.000000000041A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000041B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248337323.000000000045A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248397664.0000000000468000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248434205.0000000000478000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248452681.000000000047A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 7d244472630b58a29b7541b459fae0e3bff9da3453a4b1d2132f29d339106455
Instruction ID: 4b6721c2f46f6ec19de31be8e80d418daffa9163560deb66ef4985a72fcc5e29
Opcode Fuzzy Hash: 7d244472630b58a29b7541b459fae0e3bff9da3453a4b1d2132f29d339106455
Instruction Fuzzy Hash: 313157B1504705EFDB268F54C888B9ABFB4FF08344F508519EA566BA50C3B0AAA5DB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 2704, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 2704, Parent PID: 4004COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00357B96 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
fileCOMMON

Function 003B7AD1 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 003AF0BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 003B84FD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Function 003AF5C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 003B1F1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 003611B7 Relevance: 4.6, APIs: 3, Instructions: 133
registryCOMMON

Function 003ADF9A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00357E4A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
fileCOMMON

Function 00357A03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
fileCOMMON

Function 003AF6A9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 003B2136 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 003B1AA2 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 003B7E74 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 37
memoryCOMMON