Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559008
MD5:	8016e5d93e55bb0356c789bb6ba0bdbe
SHA1:	d22bb6723ea29ff986bdbcda2943b6f77f9121e6
SHA256:	683609cf5dad7e5a984bf4ebab65c2fa2a6d59724507b7c5e9d240932f2994a4
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5748 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8016E5D93E55BB0356C789BB6BA0BDBE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2194395926.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0047E128

0_2_0047E128

Source: file.exe, 00000000.00000002.2329305190.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2187199622.0000000000476000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2847744 > 1048576

Source: file.exe

Static PE information: Raw size of jwaseymg is bigger than: 0x100000 < 0x2b1400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.470000.0.unpack :EW;.rsrc:W;.idata :W;jwaseymg:EW;reksrrmv:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2c251f should be: 0x2c6e14

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: jwaseymg
Source: file.exe	Static PE information: section name: reksrrmv
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E7FF push esi; mov dword ptr [esp], edx	0_2_0047EC78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E7FF push ebx; mov dword ptr [esp], eax	0_2_0047EE52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E7FF push edx; mov dword ptr [esp], 050C7F1Fh	0_2_0047EE56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047E7FF push esi; mov dword ptr [esp], ebp	0_2_0047F419
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDB67 push ebx; mov dword ptr [esp], 7FEFE766h	0_2_005FDBA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDB67 push edi; mov dword ptr [esp], 5BFF7E1Dh	0_2_005FDBCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDB67 push ebp; mov dword ptr [esp], esi	0_2_005FDBD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDB67 push eax; mov dword ptr [esp], 7F6DFD1Dh	0_2_005FDBF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDCCE push edi; mov dword ptr [esp], 6BFFDA01h	0_2_005FDCF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDCCE push eax; mov dword ptr [esp], 0B5201A8h	0_2_005FDD1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060AD07 push eax; mov dword ptr [esp], esi	0_2_0060B4A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060D06B push eax; mov dword ptr [esp], edi	0_2_0060D07C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048106C push edi; mov dword ptr [esp], 7ABF3CA7h	0_2_004824AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071805C push edi; mov dword ptr [esp], eax	0_2_0071809D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00611052 push eax; mov dword ptr [esp], edi	0_2_00611053
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048307E push edi; mov dword ptr [esp], 00000000h	0_2_0048307F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060905A push edi; mov dword ptr [esp], eax	0_2_0060905C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060905A push esi; mov dword ptr [esp], 3DC13DD4h	0_2_00609063
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047C039 push 22A00B2Ah; mov dword ptr [esp], edi	0_2_0047C5A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B40EF push 1DA8A3F8h; mov dword ptr [esp], esi	0_2_006B4139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060D0C8 push eax; mov dword ptr [esp], ebx	0_2_0060D1DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FE0F4 push ebx; mov dword ptr [esp], 4BFFCDD2h	0_2_005FE159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FE0F4 push edi; mov dword ptr [esp], 02F9F321h	0_2_005FE17D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FE0F4 push 07037093h; mov dword ptr [esp], eax	0_2_005FE281
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060B089 push eax; mov dword ptr [esp], 67BB165Eh	0_2_0060F288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004810B1 push edx; mov dword ptr [esp], 02FFDA50h	0_2_004810D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047F145 push ecx; mov dword ptr [esp], esp	0_2_0047F146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00480146 push ds; retf	0_2_00480148
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060B16F push edi; mov dword ptr [esp], ebx	0_2_0060ECA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060B16F push esi; mov dword ptr [esp], ebx	0_2_00610056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064F17E push 124D59B2h; mov dword ptr [esp], eax	0_2_0064F949

Source: file.exe

Static PE information: section name: entropy: 7.7732611689992375

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7A34 second address: 5F7A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1858813946h 0x0000000a jmp 00007F185881394Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FDF6D second address: 5FDF71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE0FA second address: 5FE130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F1858813951h 0x0000000b popad 0x0000000c jmp 00007F1858813958h 0x00000011 pop esi 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE130 second address: 5FE134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE2C4 second address: 5FE2D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1858813950h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6015DB second address: 601626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007F18593F4D66h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D1DD5h], edx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F18593F4D68h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 push E2675093h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F18593F4D6Fh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601723 second address: 6017C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 nop 0x00000007 jmp 00007F1858813959h 0x0000000c push 00000000h 0x0000000e xor dword ptr [ebp+122D1DEFh], edx 0x00000014 push B1CB04B6h 0x00000019 jo 00007F1858813957h 0x0000001f jmp 00007F1858813951h 0x00000024 add dword ptr [esp], 4E34FBCAh 0x0000002b mov edi, dword ptr [ebp+122D2FBCh] 0x00000031 push 00000003h 0x00000033 pushad 0x00000034 add dh, 00000060h 0x00000037 push eax 0x00000038 mov dword ptr [ebp+122D328Dh], eax 0x0000003e pop ebx 0x0000003f popad 0x00000040 push 00000000h 0x00000042 jnp 00007F185881394Ch 0x00000048 sub dword ptr [ebp+122D38D3h], ebx 0x0000004e push 00000003h 0x00000050 movsx edx, dx 0x00000053 call 00007F1858813949h 0x00000058 pushad 0x00000059 push edi 0x0000005a push ebx 0x0000005b pop ebx 0x0000005c pop edi 0x0000005d jnc 00007F1858813957h 0x00000063 jmp 00007F1858813951h 0x00000068 popad 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6017C2 second address: 6017C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6018C7 second address: 6018D1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F185881394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6018D1 second address: 601920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push esi 0x0000000a mov si, dx 0x0000000d pop edx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F18593F4D68h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a call 00007F18593F4D69h 0x0000002f push eax 0x00000030 push edx 0x00000031 push esi 0x00000032 jmp 00007F18593F4D6Dh 0x00000037 pop esi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601920 second address: 601926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601926 second address: 6019F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007F18593F4D72h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push ebx 0x00000014 push eax 0x00000015 jmp 00007F18593F4D72h 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007F18593F4D77h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edi 0x0000002a pop edi 0x0000002b pop eax 0x0000002c pop edx 0x0000002d pop eax 0x0000002e mov esi, dword ptr [ebp+122D31E8h] 0x00000034 push 00000003h 0x00000036 mov si, bx 0x00000039 push 00000000h 0x0000003b sbb esi, 487616C3h 0x00000041 push 00000003h 0x00000043 mov edx, 6A6F4206h 0x00000048 push 955E24AEh 0x0000004d jp 00007F18593F4D7Dh 0x00000053 jmp 00007F18593F4D77h 0x00000058 xor dword ptr [esp], 555E24AEh 0x0000005f pushad 0x00000060 jc 00007F18593F4D66h 0x00000066 popad 0x00000067 lea ebx, dword ptr [ebp+12457496h] 0x0000006d mov edi, dword ptr [ebp+122D2E98h] 0x00000073 mov cx, dx 0x00000076 push eax 0x00000077 jnl 00007F18593F4D81h 0x0000007d push eax 0x0000007e push edx 0x0000007f jmp 00007F18593F4D73h 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622527 second address: 622532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1858813946h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622532 second address: 622557 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F18593F4D70h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622557 second address: 62255C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620363 second address: 620369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620369 second address: 62036D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207DB second address: 620809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 jns 00007F18593F4D81h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620964 second address: 620980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1858813950h 0x00000009 js 00007F1858813946h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620D84 second address: 620DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F18593F4D73h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621667 second address: 62166F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62166F second address: 62167B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F18593F4D66h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62167B second address: 62167F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62167F second address: 6216AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F18593F4D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F18593F4D78h 0x00000013 jp 00007F18593F4D66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621CEC second address: 621CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621E5C second address: 621E75 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F18593F4D66h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F18593F4D6Ah 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621FC0 second address: 621FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621FC4 second address: 621FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623BD1 second address: 623BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1858813959h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623BF1 second address: 623C07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D6Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623C07 second address: 623C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F1858813952h 0x0000000d jng 00007F1858813946h 0x00000013 je 00007F1858813946h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c jmp 00007F1858813958h 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628758 second address: 62875E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62875E second address: 628763 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628CBF second address: 628CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627D8F second address: 627D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627D95 second address: 627D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627D9A second address: 627DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628E44 second address: 628E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5EDE second address: 5F5EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6305E9 second address: 630601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F18593F4D73h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F18593F4D6Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6C99 second address: 5E6C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61550B second address: 615525 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F18593F4D66h 0x00000008 jl 00007F18593F4D66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F18593F4D66h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FCF5 second address: 62FD0B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1858813946h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F1858813946h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FE8A second address: 62FE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FE94 second address: 62FEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1858813946h 0x0000000a jnp 00007F1858813946h 0x00000010 popad 0x00000011 jbe 00007F1858813958h 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6301BE second address: 6301D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D70h 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6302FA second address: 630300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63046F second address: 630486 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F18593F4D6Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630486 second address: 630490 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630490 second address: 630496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E7D second address: 633E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634669 second address: 63466D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634985 second address: 6349BE instructions: 0x00000000 rdtsc 0x00000002 js 00007F1858813948h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F1858813953h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1858813956h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634B1A second address: 634B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6350BD second address: 635131 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813953h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F1858813946h 0x00000010 jmp 00007F185881394Fh 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 xor di, 60FBh 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D2D09h], esi 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F1858813948h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 00000015h 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 jp 00007F185881394Ch 0x00000047 jnc 00007F1858813946h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635131 second address: 635136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635999 second address: 6359BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1858813959h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637429 second address: 63742D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637FE3 second address: 637FE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637C83 second address: 637CAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F18593F4D7Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637CAD second address: 637CB7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F185881394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638A7F second address: 638AAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F18593F4D66h 0x00000009 jmp 00007F18593F4D73h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jbe 00007F18593F4D78h 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007F18593F4D66h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638AAD second address: 638AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E079 second address: 63E0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnc 00007F18593F4D66h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 nop 0x00000018 sub edi, dword ptr [ebp+122D2FFCh] 0x0000001e push 00000000h 0x00000020 jp 00007F18593F4D6Ch 0x00000026 mov ebx, dword ptr [ebp+122D2F24h] 0x0000002c mov dword ptr [ebp+122D3797h], eax 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F18593F4D68h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122DBC6Ah], edi 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E0DB second address: 63E0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E0E1 second address: 63E0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F09E second address: 63F0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F0A3 second address: 63F135 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F18593F4D6Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F18593F4D6Ch 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F18593F4D68h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c jg 00007F18593F4D6Ch 0x00000032 mov di, E9E4h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F18593F4D68h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D3507h] 0x00000058 push 00000000h 0x0000005a sbb bx, B5BDh 0x0000005f xchg eax, esi 0x00000060 jp 00007F18593F4D72h 0x00000066 ja 00007F18593F4D6Ch 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F135 second address: 63F14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F185881394Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F14A second address: 63F150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640072 second address: 640078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640078 second address: 64007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64007D second address: 640093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1858813952h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6410B4 second address: 6410B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64215C second address: 642162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641291 second address: 641297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642162 second address: 642166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641297 second address: 64129B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64129B second address: 641325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F185881394Ah 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F1858813948h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 xor dword ptr [ebp+122D3507h], eax 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F1858813948h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 cmc 0x00000051 mov dword ptr fs:[00000000h], esp 0x00000058 mov edi, 7B32BEF6h 0x0000005d mov eax, dword ptr [ebp+122D07B9h] 0x00000063 mov ebx, dword ptr [ebp+1245E395h] 0x00000069 push FFFFFFFFh 0x0000006b add dword ptr [ebp+122D38F1h], ebx 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 jne 00007F1858813946h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6422FB second address: 642305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F18593F4D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641325 second address: 641338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F185881394Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643123 second address: 643127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641338 second address: 641351 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F185881394Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642305 second address: 642313 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643127 second address: 643195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jnc 00007F1858813959h 0x00000010 jmp 00007F1858813953h 0x00000015 mov ebx, dword ptr [ebp+124695E9h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F1858813948h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 push ebx 0x00000038 jns 00007F185881394Bh 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 add edi, 4E4EA2D7h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F185881394Bh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642313 second address: 642319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643195 second address: 6431AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1858813951h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642319 second address: 64231E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64231E second address: 642328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1858813946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642328 second address: 64232C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6432D0 second address: 6432D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644451 second address: 64445E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6432D4 second address: 6432DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6432DA second address: 643351 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov ax, 277Eh 0x0000000e adc ax, 2004h 0x00000013 popad 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F18593F4D68h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c xor dword ptr [ebp+122D3512h], ebx 0x00000042 mov eax, dword ptr [ebp+122D11E5h] 0x00000048 add dword ptr [ebp+1245E6C3h], edx 0x0000004e push FFFFFFFFh 0x00000050 jmp 00007F18593F4D78h 0x00000055 nop 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643351 second address: 643355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646184 second address: 646188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643355 second address: 64335F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1858813946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646188 second address: 64619A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jnp 00007F18593F4D66h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64619A second address: 64619F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64619F second address: 646204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F18593F4D66h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F18593F4D68h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 js 00007F18593F4D6Ch 0x0000002e sub ebx, 285BCDEEh 0x00000034 mov ebx, 50D40364h 0x00000039 push 00000000h 0x0000003b sub dword ptr [ebp+12474D80h], ebx 0x00000041 xor dword ptr [ebp+122D25DAh], esi 0x00000047 push 00000000h 0x00000049 pushad 0x0000004a mov cx, D691h 0x0000004e add bx, 631Ah 0x00000053 popad 0x00000054 push eax 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646204 second address: 646208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6472E5 second address: 6472E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A234 second address: 64A25A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F185881394Ch 0x00000008 js 00007F1858813946h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1858813953h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B1E0 second address: 64B1EA instructions: 0x00000000 rdtsc 0x00000002 js 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B1EA second address: 64B209 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F185881394Ah 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F185881394Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B209 second address: 64B25F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F18593F4D6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add dword ptr [ebp+12466F2Eh], esi 0x00000011 push 00000000h 0x00000013 mov edi, ecx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F18593F4D68h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D3108h] 0x00000037 push eax 0x00000038 jp 00007F18593F4D74h 0x0000003e pushad 0x0000003f jnc 00007F18593F4D66h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647412 second address: 647425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F185881394Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647425 second address: 647449 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F18593F4D75h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6493F9 second address: 6493FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6493FD second address: 649403 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649403 second address: 649432 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F185881395Ah 0x00000008 jmp 00007F1858813954h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F185881394Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649432 second address: 649436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A406 second address: 64A410 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1858813946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649436 second address: 64943C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64943C second address: 649442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649442 second address: 649446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D287 second address: 64D28B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6494F6 second address: 649500 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649500 second address: 649526 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813958h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F1858813946h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649526 second address: 649539 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F18593F4D66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B456 second address: 64B45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C45F second address: 64C465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D3E0 second address: 64D3E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E01A second address: 65E022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E022 second address: 65E02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E02A second address: 65E043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F18593F4D66h 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007F18593F4D66h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E043 second address: 65E048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E2F9 second address: 65E2FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664026 second address: 66402C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664130 second address: 664134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664134 second address: 664138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664240 second address: 664246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 664246 second address: 66424C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66424C second address: 664250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A74B second address: 66A75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F185881394Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A75E second address: 66A77C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push ecx 0x0000000a jbe 00007F18593F4D6Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F18593F4D66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A77C second address: 66A798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813958h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA36 second address: 66AA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA3C second address: 66AA46 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1858813946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA46 second address: 66AA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F18593F4D66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA57 second address: 66AA5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AEE8 second address: 66AEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AEED second address: 66AEFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F1858813946h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AEFD second address: 66AF1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F18593F4D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F18593F4D6Bh 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AF1C second address: 66AF26 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F185881394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCE6 second address: 5EBCF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F18593F4D66h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCF3 second address: 5EBD11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813959h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F73D second address: 66F741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F741 second address: 66F747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F747 second address: 66F74C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA46 second address: 66FA50 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1858813946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FD2A second address: 66FD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F18593F4D6Ah 0x00000009 pop eax 0x0000000a jmp 00007F18593F4D71h 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6701A3 second address: 6701A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670464 second address: 670479 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F18593F4D70h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670775 second address: 67077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632342 second address: 632346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632346 second address: 63234A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63234A second address: 632350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632350 second address: 632355 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632355 second address: 63235B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632811 second address: 632827 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F185881394Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632827 second address: 63282D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63282D second address: 632831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6328AA second address: 6328AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6328AE second address: 6328B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632939 second address: 63294D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F18593F4D6Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63294D second address: 632990 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 119CC77Dh 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F1858813948h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 or di, 2C6Bh 0x0000002e call 00007F1858813949h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632990 second address: 632994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632994 second address: 6329AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813954h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6329AC second address: 6329B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6329B1 second address: 632A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1858813946h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jbe 00007F185881395Eh 0x00000014 jmp 00007F1858813958h 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e jmp 00007F185881394Dh 0x00000023 pushad 0x00000024 jnp 00007F1858813946h 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d popad 0x0000002e mov eax, dword ptr [eax] 0x00000030 jmp 00007F1858813951h 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 pushad 0x0000003a js 00007F1858813956h 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F1858813956h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632B34 second address: 632B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F18593F4D68h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jbe 00007F18593F4D68h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F18593F4D77h 0x0000001b popad 0x0000001c xchg eax, esi 0x0000001d mov cl, EEh 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 jbe 00007F18593F4D66h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63322B second address: 633256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F185881394Ch 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D2979h], edx 0x00000012 push 0000001Eh 0x00000014 mov edx, dword ptr [ebp+122D36ECh] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jno 00007F1858813946h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6334CA second address: 6334DB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6334DB second address: 6334DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6334DF second address: 63353E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F18593F4D6Dh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F18593F4D70h 0x00000016 jmp 00007F18593F4D73h 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e jg 00007F18593F4D6Eh 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 jmp 00007F18593F4D6Ah 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63361F second address: 633655 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D3748h], ecx 0x00000011 lea eax, dword ptr [ebp+124880EAh] 0x00000017 push ecx 0x00000018 jmp 00007F185881394Ch 0x0000001d pop edi 0x0000001e nop 0x0000001f push ecx 0x00000020 jo 00007F1858813948h 0x00000026 push edx 0x00000027 pop edx 0x00000028 pop ecx 0x00000029 push eax 0x0000002a push ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633655 second address: 633659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677F4A second address: 677F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677F4E second address: 677F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F18593F4D6Ah 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677F65 second address: 677F97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813959h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jnl 00007F1858813946h 0x00000012 jmp 00007F185881394Bh 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677F97 second address: 677FC2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F18593F4D68h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F18593F4D79h 0x00000011 jns 00007F18593F4D66h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678125 second address: 678144 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1858813946h 0x00000008 jmp 00007F1858813955h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6782A8 second address: 6782AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E1A8 second address: 67E1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1858813946h 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007F1858813946h 0x00000012 jbe 00007F1858813946h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E1C3 second address: 67E1D8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F18593F4D68h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F18593F4D76h 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D146 second address: 67D14F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D2C7 second address: 67D2D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnp 00007F18593F4D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D586 second address: 67D58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D71B second address: 67D739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F18593F4D76h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F93DA second address: 5F93FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F185881398Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F1858813946h 0x00000014 jmp 00007F1858813951h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6884FD second address: 688503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688503 second address: 688528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007F1858813960h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1858813958h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688528 second address: 68852D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B089 second address: 68B0AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jc 00007F1858813946h 0x0000000b popad 0x0000000c jg 00007F1858813952h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B0AD second address: 68B0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F18593F4D66h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F18593F4D70h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop eax 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6902A7 second address: 6902B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6902B5 second address: 6902B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6906CE second address: 6906D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6906D2 second address: 6906D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6906D6 second address: 6906E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6906E0 second address: 6906EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F18593F4D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632FEC second address: 633065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+124880E5h] 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F1858813948h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c jmp 00007F1858813953h 0x00000031 add eax, ebx 0x00000033 jmp 00007F1858813956h 0x00000038 nop 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633065 second address: 63306B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690815 second address: 690819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690819 second address: 690837 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F18593F4D66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F18593F4D6Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690837 second address: 69083B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69083B second address: 69084A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69084A second address: 690864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 je 00007F1858813946h 0x0000000e jng 00007F1858813946h 0x00000014 popad 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694C64 second address: 694C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F18593F4D66h 0x0000000c jmp 00007F18593F4D75h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694C86 second address: 694C9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1858813950h 0x00000008 pop ebx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694F27 second address: 694F4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F18593F4D66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695207 second address: 69521D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F185881394Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69521D second address: 695228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695228 second address: 69522E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69522E second address: 695240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 ja 00007F18593F4D66h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698819 second address: 698844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813955h 0x00000007 jmp 00007F1858813952h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F287F second address: 5F2885 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2885 second address: 5F2893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F1858813948h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2893 second address: 5F2898 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2898 second address: 5F289E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F289E second address: 5F28B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F18593F4D6Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698246 second address: 69824A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69EEB6 second address: 69EEE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D77h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F18593F4D6Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F052 second address: 69F06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1858813958h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F06F second address: 69F075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F392 second address: 69F396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F396 second address: 69F39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F6E3 second address: 69F6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F6E7 second address: 69F6FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F18593F4D6Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F9CF second address: 69F9EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813956h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FCAC second address: 69FCB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0AEB second address: 6A0B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1858813955h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0B04 second address: 6A0B08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0B08 second address: 6A0B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5B3B second address: 6A5B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5B41 second address: 6A5B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F185881394Ch 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8779 second address: 5E87AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D77h 0x00000007 jl 00007F18593F4D66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F18593F4D72h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4D23 second address: 6A4D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4D27 second address: 6A4D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4D35 second address: 6A4D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A556C second address: 6A5572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5572 second address: 6A5578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF1FB second address: 5EF201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACB28 second address: 6ACB4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813950h 0x00000007 jnl 00007F185881394Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F185881396Dh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACB4F second address: 6ACB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F18593F4D6Fh 0x00000009 jbe 00007F18593F4D66h 0x0000000f popad 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2EFE second address: 6B2F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3036 second address: 6B3040 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F18593F4D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3040 second address: 6B3047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31B6 second address: 6B31BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31BB second address: 6B31C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31C1 second address: 6B31C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31C7 second address: 6B31F5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1858813946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F185881394Ch 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F1858813953h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3713 second address: 6B3728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F18593F4D66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jns 00007F18593F4D66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3728 second address: 6B3740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1858813950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3EA6 second address: 6B3EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3EAA second address: 6B3EAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3EAE second address: 6B3EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F18593F4D66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B483D second address: 6B4855 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F185881394Eh 0x00000008 ja 00007F185881394Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B2662 second address: 6B2674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F18593F4D6Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B7027 second address: 6B7039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jno 00007F1858813946h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8810 second address: 6B881C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F18593F4D66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B881C second address: 6B8821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8821 second address: 6B8851 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F18593F4D6Ch 0x00000008 jmp 00007F18593F4D70h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F18593F4D6Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE0A1 second address: 6BE0D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnp 00007F1858813946h 0x00000010 jmp 00007F185881394Eh 0x00000015 popad 0x00000016 jmp 00007F1858813955h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDB46 second address: 6BDB70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D74h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F18593F4D72h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFA0F second address: 6CFA19 instructions: 0x00000000 rdtsc 0x00000002 je 00007F185881394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D27DB second address: 6D27DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D27DF second address: 6D2805 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1858813946h 0x00000008 jmp 00007F1858813952h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F1858813946h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2805 second address: 6D280D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D280D second address: 6D2822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1858813951h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2371 second address: 6D2375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D73B1 second address: 6D73B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D73B5 second address: 6D73B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5EB4 second address: 6D5EB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5FF5 second address: 6D5FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA5CF second address: 6DA5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1858813946h 0x0000000a pop eax 0x0000000b jnc 00007F1858813960h 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0BD4 second address: 6E0BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A1C second address: 6E0A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A20 second address: 6E0A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F18593F4D78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F18593F4D68h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F18593F4D6Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0A55 second address: 6E0A68 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1858813946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E83F4 second address: 6E83F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E855F second address: 6E8565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8565 second address: 6E856A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87F1 second address: 6E87F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87F5 second address: 6E87FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87FB second address: 6E8810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F185881394Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8810 second address: 6E8843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F18593F4D72h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F18593F4D78h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBD67 second address: 6FBD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBBCF second address: 6FBBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714B98 second address: 714BA9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1858813946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714BA9 second address: 714BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F18593F4D78h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jc 00007F18593F4D66h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714BD0 second address: 714BDA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1858813946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714BDA second address: 714BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714BE0 second address: 714BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F185881394Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713DB3 second address: 713DBD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71422E second address: 714232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714232 second address: 714254 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F18593F4D79h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7143B1 second address: 7143B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7143B7 second address: 7143C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7143C1 second address: 7143C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714566 second address: 71456E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71456E second address: 71459A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 jmp 00007F185881394Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1858813955h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D147 second address: 71D14B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72076F second address: 72077A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72077A second address: 720794 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F18593F4D6Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007F18593F4D66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7202F6 second address: 720303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F1858813946h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720303 second address: 720323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F18593F4D71h 0x0000000e push edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7222F8 second address: 722302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1858813946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722302 second address: 72232D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F18593F4D6Fh 0x00000008 jno 00007F18593F4D66h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edi 0x00000015 pop edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72232D second address: 722333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722333 second address: 722339 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717B9F second address: 717BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717EAE second address: 717EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717EB5 second address: 717EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F185881394Ah 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jno 00007F1858813962h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718F44 second address: 718F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 47DF56 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6525D6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6C0462 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 481744 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6DA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005FDB67 rdtsc

0_2_005FDB67

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 5452

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00661E8F GetSystemInfo,VirtualAlloc,

0_2_00661E8F

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005FDB67 rdtsc

0_2_005FDB67

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0047B7CA LdrInitializeThunk,

0_2_0047B7CA

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: nProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0065766E GetSystemTime,GetFileTime,

0_2_0065766E

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559008
Start date and time:	2024-11-20 03:19:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net
Report size getting too big, too many NtProtectVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	Benefit Enrollment -wZ5nusm.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	6GvQSVIEIu.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	217469812STM.pdf	Get hash	malicious	ScreenConnect Tool, Phisher	Browse	199.232.210.172
	file.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172
	beacon_x64.exe	Get hash	malicious	CobaltStrike	Browse	199.232.210.172
	DellTpm1.2_Fw5.81.2.1_V3_64.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	199.232.210.172

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4856441773881786
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'847'744 bytes
MD5:	8016e5d93e55bb0356c789bb6ba0bdbe
SHA1:	d22bb6723ea29ff986bdbcda2943b6f77f9121e6
SHA256:	683609cf5dad7e5a984bf4ebab65c2fa2a6d59724507b7c5e9d240932f2994a4
SHA512:	02a0988cdf9fad5e64893c9271ca4b7cd9008214193c713b1e068912461a7e4d01342c97c96ab0091c25c7444705ba516ef7349ead6843f9cfb9127278d1d0c0
SSDEEP:	24576:hrIAqSlyHUp/CpYC0PXgE7qtliQJAmn7qdfYKs0ufkqhrLKN5KOVCOo7fU7wBBZF:hUulZ4QaE7hN5KKo7MsBBL0DuWZB9I
TLSH:	13D53BA2B90572CFD88A27B85527CDC2595D47B90B1588D3DCB874BA7E73CC122BBC18
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,......%,...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6be000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F18593E9A1Ah
rsqrtps xmm5, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	d9bddb36b7fd1cbd4577902b95732fd3	False	0.9307725694444444	data	7.7732611689992375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jwaseymg	0xa000	0x2b2000	0x2b1400	99e44771cfd670478379a63c0163e87c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
reksrrmv	0x2bc000	0x2000	0x400	7076913c94571e3d6588e6f87b56e34c	False	0.787109375	data	6.188617823505462	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2be000	0x4000	0x2200	3019bdaec025eb0976ac79baeb8d735b	False	0.05514705882352941	DOS executable (COM)	0.8171357940523709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 03:20:10.678772926 CET	1.1.1.1	192.168.2.5	0x9567	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 20, 2024 03:20:10.678772926 CET	1.1.1.1	192.168.2.5	0x9567	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	21:20:17
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x470000
File size:	2'847'744 bytes
MD5 hash:	8016E5D93E55BB0356C789BB6BA0BDBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	3.5%
Signature Coverage:	5.5%
Total number of Nodes:	344
Total number of Limit Nodes:	20

Executed Functions

Function 00661E8F Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11E55FEC), ref: 00661E9B
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00661EFC

Memory Dump Source

Source File: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 01bfafecf76a6a0d096a515ce9d0782433c2973a99af1a2f8c54efdc54e9de64
Instruction ID: b1cda726eed7f1383753827764036e9d7f8815ac109b8be3608b4fb130a651f6
Opcode Fuzzy Hash: 01bfafecf76a6a0d096a515ce9d0782433c2973a99af1a2f8c54efdc54e9de64
Instruction Fuzzy Hash: 7E410FB2900607AFE729DF608845BA6B7ADFF48740F084066A602DE982D67095D0CBE4

Function 005FDB67 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 005FDB67

Memory Dump Source

Source File: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 96cb221779b5dbcc095fd7fe7016ab78a518651b4a214e31075fe6d9429018c9
Instruction ID: f97d8e7c4d161b206725514d963da37aee29b934abef77074884ed637e4111ea
Opcode Fuzzy Hash: 96cb221779b5dbcc095fd7fe7016ab78a518651b4a214e31075fe6d9429018c9
Instruction Fuzzy Hash: 0C317AB2408220AFD7117F19D841A7EFBF9EF84760F164C2EE6D483240D6345854CBAB

Function 0047B7CA Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0047B93A

Memory Dump Source

Source File: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: ca44ed21baaabe4879d936ed9fa82d122553004928ec54e3e91f042c58538119
Instruction ID: 3f06333d2cf9a3365ea93b605f5159cccdc8412b68525ffc43a68cdbaa8921cc
Opcode Fuzzy Hash: ca44ed21baaabe4879d936ed9fa82d122553004928ec54e3e91f042c58538119
Instruction Fuzzy Hash: 14E08CB11046899ACF26AF618D027E9360ADB40704F61852BBB199AE59CB2D081287DA

Function 00654BF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00654D05
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00654D19

Strings

.exe, xrefs: 00654C60
.dll, xrefs: 00654C3C
1002, xrefs: 00654CCF

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 358ec6fe12954e0231828ce312f580ecdc7637299f5c27dffa6dd29b78a2e632
Instruction ID: 43d388b8e600e9a72b5ff0207fbe748956efa8482217ac92ad70a73debbeb9f6
Opcode Fuzzy Hash: 358ec6fe12954e0231828ce312f580ecdc7637299f5c27dffa6dd29b78a2e632
Instruction Fuzzy Hash: 1131DC31405109EFDF20AF50D908AAD7B77FF4834AF1082A9FD0656221CF318AE9DB95

Function 006550FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,0065508C,?,00000000,00000000), ref: 006551B7
GetModuleHandleA.KERNEL32(00000000,?,?,?,0065508C,?,00000000,00000000), ref: 006551C5

Strings

.dll, xrefs: 0065512D

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: cfd50e139286997a4db959d9dcea00596d4387b78d3f76fe261e0eb5551cd6fb
Instruction ID: 5a0370a8d80c61d48150401175ad854dd85b9289c23cd06686c7efbc3352396e
Opcode Fuzzy Hash: cfd50e139286997a4db959d9dcea00596d4387b78d3f76fe261e0eb5551cd6fb
Instruction Fuzzy Hash: FB112A30104E0AEAFF319FA4C81D7A97BB6FF00746F114225AC02456E1DBB19ADDDA91

Function 00657A54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00CBA294,-11E55FEC), ref: 00657ACD
GetFileAttributesA.KERNEL32(00000000,-11E55FEC), ref: 00657ADB

Strings

@, xrefs: 00657A80

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 792bbb73e90ad588ec20ed8874b95218dae97b82b5967c8914271a96dfad9083
Instruction ID: f836b82cbb8f0a5eb39fea96e09dc54e2a369dd046f84936c076aacb0ecbe285
Opcode Fuzzy Hash: 792bbb73e90ad588ec20ed8874b95218dae97b82b5967c8914271a96dfad9083
Instruction Fuzzy Hash: 1A018170508509FAEF11DF64ED09B9DBE72EF40386F104158EC03651A1C7B09B9EEB04

Function 00653AD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00653B36

Strings

\\?\, xrefs: 00653B91

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 70957b4d9221fbe0900758849eb50fdfd68b5a57f10b9890b5a8a5da8d5aeb7f
Instruction ID: 1e1fbc0a3b6346b55aeb620d5d943bbd6694433aaa18362d9c21b12587a75b55
Opcode Fuzzy Hash: 70957b4d9221fbe0900758849eb50fdfd68b5a57f10b9890b5a8a5da8d5aeb7f
Instruction Fuzzy Hash: 8431397590021EBFEF219F94CD09BDEBAB7FF08B82F001554F901A5260E7329A69DB54

Function 006551E3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00655247

Strings

.dll, xrefs: 00655204

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: 9cfabc2b5ee789634854123035e761024b29884061b605687579e819e37c4e39
Instruction ID: 86c359be34123636f5e7be88410e1442caac0f7434a47b507fcbf49a7d3863cc
Opcode Fuzzy Hash: 9cfabc2b5ee789634854123035e761024b29884061b605687579e819e37c4e39
Instruction Fuzzy Hash: 92F0B475200609AFDF009F94CC49BAE3BA2FF14395F108018FD0649252D330C7A9EB10

Function 00657C70 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00CBA294,?,?,-11E55FEC,?,?,?,-11E55FEC,?), ref: 00657D22

Part of subcall function 00657C22: IsBadWritePtr.KERNEL32(?,00000004), ref: 00657C30

CreateFileA.KERNEL32(?,?,?,-11E55FEC,?,?,?,-11E55FEC,?), ref: 00657D42

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: f61c2e06e683b0a380ea46deb8a1719f9aefb78ef65ee3fd2fbf270a136faaef
Instruction ID: a0759b0c622735f92c8c358b86152f0efecedab200881b42334f63b033dfb78f
Opcode Fuzzy Hash: f61c2e06e683b0a380ea46deb8a1719f9aefb78ef65ee3fd2fbf270a136faaef
Instruction Fuzzy Hash: 6111E47100954AFEDF129F90EE09BEE3A73BF14346F144119BD0625160C7768AAAEB91

Function 006575DC Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

GetCurrentProcess.KERNEL32(-11E55FEC), ref: 006575E9
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0065764F

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: eec1a73018c14433f1acf0a8d716648c67b84d7a3cf19e9a06ede82a19ffd6a6
Instruction ID: 1c11f2669e7146c9c6584f0955eb019ef937774ce0f9068c5f7f0784cb6e9a31
Opcode Fuzzy Hash: eec1a73018c14433f1acf0a8d716648c67b84d7a3cf19e9a06ede82a19ffd6a6
Instruction Fuzzy Hash: 9801FB3210494AEB8F526FA8EC04CEE3F76FFA9796F004115FD0591111D731C66AEB65

Function 00653521 Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00653530
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: f29c62eb83914e6727531ba09a41890bd4507768afd5e8a9c73ca1463c029afc
Instruction ID: 14043e96e4dff824890e4aa036696499f90f3843cc4659a141a6c0aad704777e
Opcode Fuzzy Hash: f29c62eb83914e6727531ba09a41890bd4507768afd5e8a9c73ca1463c029afc
Instruction Fuzzy Hash: 70F0B471501605FBE721DFA4C8447AEB3B6FF4175BF20117DD50186350E7741E49DA91

Function 00656275 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

CloseHandle.KERNELBASE(?,-11E55FEC,?,?,00655C38,?), ref: 006562B3

Strings

8\e, xrefs: 00656282

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID: 8\e
API String ID: 4003616898-4277136053
Opcode ID: eebef50f81128450274ce63f6eeed6ecb1a7167f57bc8277841d1f7b531353e8
Instruction ID: 55989a65de923b1b3db2317f3804eb10249d65bd41217efb22bc1af8c3655487
Opcode Fuzzy Hash: eebef50f81128450274ce63f6eeed6ecb1a7167f57bc8277841d1f7b531353e8
Instruction Fuzzy Hash: 53E0D862504906A5DE5037B4CC09C4F3A26EF95B8AF000125BC0245112DA60C35FC624

Function 006628BB Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cba31ad67c5304dd34bc0c01db78fdcfdf6820418f772385c567af188147850
Instruction ID: 9ed984ff04173cb7a7db7174511aff69a3ced77942c7c658b0c7e70bc89543f3
Opcode Fuzzy Hash: 6cba31ad67c5304dd34bc0c01db78fdcfdf6820418f772385c567af188147850
Instruction Fuzzy Hash: 11419D72D00A0BEFEB35CF50C854BEE7BB6FB40310F248559E502AA692C771AC91DB91

Function 005FDCCE Relevance: 1.6, APIs: 1, Instructions: 108
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 005FDCCE

Memory Dump Source

Source File: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: faca1dd29f478728cd9871c84aaf2939ae438d74225981b1757100669a5b9825
Instruction ID: fece5b404d8e20cfe584bb67f5245d7a02ce5d86f696eb5e48eb44026b8c4658
Opcode Fuzzy Hash: faca1dd29f478728cd9871c84aaf2939ae438d74225981b1757100669a5b9825
Instruction Fuzzy Hash: 973147F251C614AFE341AF19DC816BAFBEAEF98750F06492DE2C4C3610E67588418B97

Function 00655C5B Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00655D10

Part of subcall function 006535FF: RtlAllocateHeap.NTDLL(00000000,00000000,006532A8,?,?,006532A8,00000008), ref: 00653619

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocateCreateFileHeap
String ID:
API String ID: 3125202945-0
Opcode ID: 52bb7b599174c793388f32d7bcd7f51e859eaa06510dbf59540231b8f614cc70
Instruction ID: e6b0d66d468c51710a98dc9845b6fd4b5464e80d480f8d3f877e3f3b3d25dfb6
Opcode Fuzzy Hash: 52bb7b599174c793388f32d7bcd7f51e859eaa06510dbf59540231b8f614cc70
Instruction Fuzzy Hash: E431C071900604FEEB209F60DC4DFADBBB9FF04715F208229F906AA291D7719A4ACB54

Function 00655477 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006535FF: RtlAllocateHeap.NTDLL(00000000,00000000,006532A8,?,?,006532A8,00000008), ref: 00653619

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 006554F9

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocateCreateFileHeap
String ID:
API String ID: 3125202945-0
Opcode ID: 20a053188d6c3a9464be28ff79873f8ed6b6d35f0856857ffca7183688f207f1
Instruction ID: fd8ae95e6bc0ef2e261d8e5e8612f6d49710b6e2bd1ad393e7a7419431849a37
Opcode Fuzzy Hash: 20a053188d6c3a9464be28ff79873f8ed6b6d35f0856857ffca7183688f207f1
Instruction Fuzzy Hash: D8313971500B04BEEB209F64DC49F9D77BAFF04725F204229FA12AA1D1D3B1A645CB54

Function 00662608 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 006626B5

Memory Dump Source

Source File: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: ee20e6568aa4899ef570e626a8b1b11516d95a80e04b4246bd155ef3350bb72b
Instruction ID: 22e90c3bedcd129c9a61b749eb76feafba030b68ea1d7873e0a96eb3b107b2d1
Opcode Fuzzy Hash: ee20e6568aa4899ef570e626a8b1b11516d95a80e04b4246bd155ef3350bb72b
Instruction Fuzzy Hash: 2B11D072A05A6BABEF349A14CC68BEB776DEF14714F104096E845E2241D7B09DC0CBA0

Function 04D40D42 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D40DCD

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 52bf0e50f98e95f9a76eefe04918dad1489bd05b36625a7352a44c1ff6012c13
Instruction ID: ca6944c3bc6cd6e2c79755989e80fdbf63dc2d28381ea838c84f4dd77bc39bde
Opcode Fuzzy Hash: 52bf0e50f98e95f9a76eefe04918dad1489bd05b36625a7352a44c1ff6012c13
Instruction Fuzzy Hash: 8B2133B6C012089FCB11CFA9D884ADEFBB4FF88310F14811ADA08AB205D738A544CFA5

Function 04D40D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D40DCD

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9cbfc5883088d8ec36cec135ace5e18b520956406de71904c29458ae0fc17330
Instruction ID: 258e8abbb4c9cfe55dd3144da2ab3f8d84e02542fcdc6debdb71b0009ab14122
Opcode Fuzzy Hash: 9cbfc5883088d8ec36cec135ace5e18b520956406de71904c29458ae0fc17330
Instruction Fuzzy Hash: 1E2124B6C012189FCB50CF99D884ADEFBF4FF88310F14851AD908AB204D734A544CFA5

Function 04D41510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D41580

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 56d3d47d35cee5c7d3d45f01514abd02f0bb04e3887086e7e737c238c3d168fc
Instruction ID: 7cee84f3aaf03ea696d555b0f2533135fc6a55ab43daff8d695649632f9d645a
Opcode Fuzzy Hash: 56d3d47d35cee5c7d3d45f01514abd02f0bb04e3887086e7e737c238c3d168fc
Instruction Fuzzy Hash: 6B11E4B19002499FDB10CF9AD588BDEFBF4FB48320F10842AE559A3250D378A684CFA5

Function 04D41509 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D41580

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: db32cab8bdfa4018bcc63aa48dd516ab7ee9176eb9fe99a371b5682d3b2e0dc3
Instruction ID: 408984e737994a2406a0a58fc463a0410246224b2e5ac4be6ddcedd092accbfc
Opcode Fuzzy Hash: db32cab8bdfa4018bcc63aa48dd516ab7ee9176eb9fe99a371b5682d3b2e0dc3
Instruction Fuzzy Hash: 182117B5900249CFDB10CF9AC544BDEFBF4FB48310F14842AE558A7250C378A584CFA5

Function 04D41301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D41367

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 02c250703dbbe0f8660e4e9f0a18a17e0f80089b038b1a5d092da37d0ec964a4
Instruction ID: dfb769e8ad11ba00561a83c236016a4128b4746e2811ec1842efe90f71fe4207
Opcode Fuzzy Hash: 02c250703dbbe0f8660e4e9f0a18a17e0f80089b038b1a5d092da37d0ec964a4
Instruction Fuzzy Hash: 1E1125B1800249CFDB10DF9AD449BEEFBF4EF48324F24846AD558A3250D778A584CFA5

Function 04D41308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D41367

Memory Dump Source

Source File: 00000000.00000002.2332262216.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d40000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 01035b47e2ecbc648575d2c0d56b8fa2e98f67f2452b0f0680746b9310736715
Instruction ID: d0c7e42e80d574a931668d9b3cee350576e814df2e401cf6c06402b048437b37
Opcode Fuzzy Hash: 01035b47e2ecbc648575d2c0d56b8fa2e98f67f2452b0f0680746b9310736715
Instruction Fuzzy Hash: 691148B1800249CFDB10CF9AC448BDEFBF8EF48320F14841AD558A3240C778A584CFA5

Function 00657E74 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

ReadFile.KERNELBASE(?,00000400,?,?,00655BA3,-11E55FEC,?,?,00655BA3,?,?,00000400,?,00000000), ref: 00657EE0

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: 9976747a6bbf9171aa490a96705c280dedfaeb13746baccd63542ddef2b69060
Instruction ID: 3907baf55acb50a58a49629bdf85d5d0281deb913ceaa25ed7d23b10ec461e50
Opcode Fuzzy Hash: 9976747a6bbf9171aa490a96705c280dedfaeb13746baccd63542ddef2b69060
Instruction Fuzzy Hash: 95F03C3210460AEBCF12AF94DC0AD9E3F67FF58746F004455FD0155121D732CAAAEB61

Function 00654E57 Relevance: 1.5, APIs: 1, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0065460D,0065460D), ref: 00654EA2

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 728c60800bbd137f0fd0fbac09fdab5b45512a555c002c71fa07c74f3bfb87a8
Instruction ID: 18518faa8702b8a3dd437fa82cd99e8c8cdcb0ce95ad47af25cfa0fb63a2260a
Opcode Fuzzy Hash: 728c60800bbd137f0fd0fbac09fdab5b45512a555c002c71fa07c74f3bfb87a8
Instruction Fuzzy Hash: 54E06D35100155BACF913B75CD0B89E3A27BF5039EF0080A5BC0554066DF31C79AD629

Function 006535FF Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,006532A8,?,?,006532A8,00000008), ref: 00653619

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3de5514871acdf1b2eee8b4176a70c18c4cdcbbe50a4edd998cde72ef82964e3
Instruction ID: d5d4d66781326a7538ead1693d652ea0d3e6deadf3d7d4a6350c683ecbc5b5a1
Opcode Fuzzy Hash: 3de5514871acdf1b2eee8b4176a70c18c4cdcbbe50a4edd998cde72ef82964e3
Instruction Fuzzy Hash: F9D01272200245B7DA205E59DC09FDF7ABCEB85F91F000129F90390140DB75E061C7B8

Function 0060AD07 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0060B49B

Memory Dump Source

Source File: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4ae40edb47c3193f0fe807b400e3f430b0943d91f19366edfb193dc9e323ca24
Instruction ID: bffdf3a353b05fa62079b6a2997a67cbd4b1eb1540339583b809669840ce6a0e
Opcode Fuzzy Hash: 4ae40edb47c3193f0fe807b400e3f430b0943d91f19366edfb193dc9e323ca24
Instruction Fuzzy Hash: 7AD017B1808B608FD3446FB8854802EBBF4EE05640F16092EE886D3100D73089808B83

Function 006536F2 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00653756

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 55605f88b21546327e0d72bcd3836f55d6831da5e9bfb94f2105e2eba85c71e3
Instruction ID: 97fd0db0c625fcad5da829ac1a853a663cd35886890a9dbc670cc6a8801f114b
Opcode Fuzzy Hash: 55605f88b21546327e0d72bcd3836f55d6831da5e9bfb94f2105e2eba85c71e3
Instruction Fuzzy Hash: 8C01E875A0011DBFDF119FA5CC04DDEBBB6FF48B82F000569A805A5260D7328665DB64

Function 00662232 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,0066222E,?,?,00661F34,?,?,00661F34,?,?,00661F34), ref: 00662252

Memory Dump Source

Source File: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0308d0231388f71a0df5268f132c4a1bee01ba6c5042fa262e96bf0d8abd431d
Instruction ID: cf0f281169236f85100b39823b34621b5b96d7372acc6aad96f8b00b07c59524
Opcode Fuzzy Hash: 0308d0231388f71a0df5268f132c4a1bee01ba6c5042fa262e96bf0d8abd431d
Instruction Fuzzy Hash: 0BF0F4B2904606EFE724CF05CD19B99BBE9FF44751F108024F44A9BA91D3B198C1CB50

Function 0047E7FF Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0047EC6B

Memory Dump Source

Source File: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 066d6c13e47d586e0910f559b68198382ad949cf38a86eab86280f43bd543cfc
Instruction ID: 49760ea509f45943ea71f4c678a0f8fbfcfbb9620a081b195dd3bb5498d6d85c
Opcode Fuzzy Hash: 066d6c13e47d586e0910f559b68198382ad949cf38a86eab86280f43bd543cfc
Instruction Fuzzy Hash: 3EF0E7B440CB08DFD3106F1AC8846BEFBF4FF19310F2149AEDAC982240E67908569A1B

Function 0047E9E0 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0047EDA1

Memory Dump Source

Source File: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a4d09a6531ebfed9447d962357d5274f0ecb06f671e51018af4831c3080c5cff
Instruction ID: fd5ddad3ead4a8f1da38e2feaf02a93184a428ffc0f94a1d8310deebb350271f
Opcode Fuzzy Hash: a4d09a6531ebfed9447d962357d5274f0ecb06f671e51018af4831c3080c5cff
Instruction Fuzzy Hash: 42D0CA7000824ECBEB546F7084082EE3B70EF0A325F20838AAC6A81AC0C6364C619E0A

Function 0065533A Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,006533C0,?,?), ref: 00655340

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a2b2551c0bf19f575bf6a055c13029d24f77772675d56671afb9cd45211e0ba2
Instruction ID: 4fc581b6be47838980ae968f97ecd9cb25075c2fcedb45b410959c5c9fceb2d5
Opcode Fuzzy Hash: a2b2551c0bf19f575bf6a055c13029d24f77772675d56671afb9cd45211e0ba2
Instruction Fuzzy Hash: A9B09B3100050977CB417F51DC0585D7F65FF11355F008114B91A54021C771D57497D4

Non-executed Functions

Function 0065766E Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

GetSystemTime.KERNEL32(?,-11E55FEC), ref: 006576A3
GetFileTime.KERNEL32(?,?,?,?,-11E55FEC), ref: 006576E6

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: 507561aa659e1473892ff836078ac20f13a7782be602e865d66c29dabb69f64e
Instruction ID: f2066898f2066ac4bcd1e45160bb752925bcba24f8e45e88c76034a12a53fe92
Opcode Fuzzy Hash: 507561aa659e1473892ff836078ac20f13a7782be602e865d66c29dabb69f64e
Instruction Fuzzy Hash: AD01E83620494AEBCF215F59EC08D8E7F76FF99756F008125F80245161D732DAA6DF21

Function 0047E128 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0047E321

Memory Dump Source

Source File: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 37be0c7292889931488a87b059c2016bd26ce24c30064ba64e6625641ff2e462
Instruction ID: b388e21532d2b4643b671f80d00616ba223c822e1eaf5a1478763eca86c01fa4
Opcode Fuzzy Hash: 37be0c7292889931488a87b059c2016bd26ce24c30064ba64e6625641ff2e462
Instruction Fuzzy Hash: 6E71B27690420ECBDB05CF27C5411DF37A1EB5E324F24C2AFD80987A82D2BA4D66DA5D

Function 00656BA4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00653521: GetCurrentThreadId.KERNEL32 ref: 00653530
Part of subcall function 00653521: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00653573

Part of subcall function 00657C22: IsBadWritePtr.KERNEL32(?,00000004), ref: 00657C30

wsprintfA.USER32 ref: 00656BEA
LoadImageA.USER32(?,?,?,?,?,?), ref: 00656CAE

Strings

%8x, xrefs: 00656C78, 00656CAB
%8x, xrefs: 00656BE5, 00656BE8

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: 14d7a2a80b7a5235a2072e601777cc24adef240a33422bb50100e60bdf1fc3c3
Instruction ID: a409ea0f81c3e712c480a2d48b519be39d7749cb4cfe0f5f75d22a78b1f55193
Opcode Fuzzy Hash: 14d7a2a80b7a5235a2072e601777cc24adef240a33422bb50100e60bdf1fc3c3
Instruction Fuzzy Hash: 9831493190010AFFDF119F94DC09EEEBBBAFF48701F108129F911A61A0D7319A65DB61

Function 00657775 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00CBA294,00004020,00000000,-11E55FEC), ref: 00657862

Strings

@, xrefs: 006577A1

Memory Dump Source

Source File: 00000000.00000002.2328287800.000000000064E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: true

Associated: 00000000.00000002.2327559229.0000000000470000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327587918.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327617144.0000000000476000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327646943.000000000047A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327681748.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327710441.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327733406.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327943262.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327972184.00000000005E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328012405.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328038591.00000000005FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.00000000005FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328061835.0000000000607000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328106983.0000000000612000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328129393.0000000000613000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328157050.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328178010.000000000061B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328199070.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328220092.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328263882.0000000000643000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328310641.0000000000658000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328335376.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328380336.000000000066D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328407424.0000000000674000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328431005.0000000000675000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328453965.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328479855.000000000067A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328503575.0000000000683000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328535104.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328560476.0000000000696000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328584034.0000000000697000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328608964.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328634676.00000000006A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328658708.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328682807.00000000006A9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328706373.00000000006AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328735153.00000000006B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328757962.00000000006B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328780727.00000000006C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328801844.00000000006C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328822338.00000000006CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328849988.00000000006CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328872754.00000000006D5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328893490.00000000006D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328933002.0000000000709000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328967672.000000000070A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.0000000000716000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2328995837.000000000071C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329050784.000000000072C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2329076534.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 7289af328df79ca05b66cd95e85abbea15924d64e3cf113028c9bd3da4550b5e
Instruction ID: 9aa1aefc3edd96003ff020ef6fc6d8add7db7fc0726f468ad3b1596e5c0eab8e
Opcode Fuzzy Hash: 7289af328df79ca05b66cd95e85abbea15924d64e3cf113028c9bd3da4550b5e
Instruction Fuzzy Hash: 82319C75508705EFDB248F54EC48B8ABBB2FF08351F008529E85667250C3B1EAA9DF80

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 5748, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 5748, Parent PID: 1028COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00661E8F Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 005FDB67 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Function 00654BF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 006550FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00657A54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00653AD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 006551E3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00657C70 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 006575DC Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00653521 Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 00656275 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 25
COMMON

Function 006628BB Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 005FDCCE Relevance: 1.6, APIs: 1, Instructions: 108
libraryCOMMON