Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559390
MD5:	bd8bd8ac55f48657780d6ff5570f98ce
SHA1:	cd99112e246d966339be39c6b3332eeeac90105c
SHA256:	9fe8f85118b90bf8fdd24659d34a1210ce35ff94fd6f52ff5e7d2dbe1f624d5e
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4796 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BD8BD8AC55F48657780D6FF5570F98CE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0055F20F CryptVerifySignatureA,

0_2_0055F20F

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2129352020.00000000050E0000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000		0_2_00502000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00528574		0_2_00528574

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 0055A204 appears 35 times

Source: file.exe, 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2263497294.000000000130E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2756608 > 1048576

Source: file.exe

Static PE information: Raw size of ywhttfna is bigger than: 0x100000 < 0x29b000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.380000.0.unpack :EW;.rsrc:W;.idata :W;ywhttfna:EW;mpyioxor:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2afd16 should be: 0x2af402

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ywhttfna
Source: file.exe	Static PE information: section name: mpyioxor
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050605D push edi; mov dword ptr [esp], 32FFCE2Eh	0_2_005060EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050605D push esi; mov dword ptr [esp], 3F6FF761h	0_2_00506112
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050605D push ebp; mov dword ptr [esp], edi	0_2_00506141
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050605D push eax; mov dword ptr [esp], edi	0_2_005061DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050605D push eax; mov dword ptr [esp], edx	0_2_005061F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038E3CA push 3E9981BBh; mov dword ptr [esp], ebp	0_2_0038E97F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038C010 push ebx; mov dword ptr [esp], esi	0_2_0038C02A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051206E push eax; mov dword ptr [esp], ebx	0_2_0051207D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038C07A push 758380C8h; mov dword ptr [esp], esp	0_2_0038C091
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039007A push eax; mov dword ptr [esp], ecx	0_2_0039110B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039007A push ebx; mov dword ptr [esp], 756B4547h	0_2_003931C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038D07D push cs; retf	0_2_0038D099
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 2AE1E553h; mov dword ptr [esp], ebx	0_2_00502089
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 72AFE392h; mov dword ptr [esp], edi	0_2_005020E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 1AC771C4h; mov dword ptr [esp], ecx	0_2_005021F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push ebp; mov dword ptr [esp], edx	0_2_00502221
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push edx; mov dword ptr [esp], ebp	0_2_00502225
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 06E888FAh; mov dword ptr [esp], esi	0_2_005022D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push edi; mov dword ptr [esp], 3B5A030Ah	0_2_0050230A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push edi; mov dword ptr [esp], 33904544h	0_2_00502378
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push ecx; mov dword ptr [esp], eax	0_2_0050238F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push esi; mov dword ptr [esp], ebp	0_2_0050244B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push ecx; mov dword ptr [esp], ebp	0_2_00502461
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 13D30B09h; mov dword ptr [esp], esp	0_2_005024FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502000 push 541E105Dh; mov dword ptr [esp], ebx	0_2_0050252E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00512000 push edx; mov dword ptr [esp], esi	0_2_005125AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00587004 push edx; mov dword ptr [esp], eax	0_2_0058702C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00513024 push ecx; mov dword ptr [esp], 74F35F29h	0_2_00513032
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00393043 push 3B8B9AD2h; mov dword ptr [esp], esi	0_2_00395158
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050402F push 153F3522h; mov dword ptr [esp], ebx	0_2_0050421F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050C0DB push 195CAE26h; mov dword ptr [esp], edi	0_2_0050C137

Source: file.exe

Static PE information: section name: entropy: 7.815000576313311

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506DCF second address: 506DE1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F995CCAC598h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505DE3 second address: 505DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50607D second address: 5060DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F995CCAC596h 0x0000000a jmp 00007F995CCAC5A4h 0x0000000f jmp 00007F995CCAC5A3h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F995CCAC5A5h 0x0000001c jmp 00007F995CCAC5A6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5064EC second address: 5064F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508992 second address: 508996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508996 second address: 508A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 70A3A196h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F995D15D9E8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a jmp 00007F995D15D9F8h 0x0000002f push 00000003h 0x00000031 push eax 0x00000032 and edi, 2BD07653h 0x00000038 pop esi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F995D15D9E8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov dword ptr [ebp+122D23AAh], edi 0x0000005b push 00000003h 0x0000005d call 00007F995D15D9E9h 0x00000062 pushad 0x00000063 pushad 0x00000064 jo 00007F995D15D9E6h 0x0000006a push edx 0x0000006b pop edx 0x0000006c popad 0x0000006d push edi 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508A30 second address: 508A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007F995CCAC5ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508A41 second address: 508A5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508A5B second address: 508A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508B1C second address: 508BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9EBh 0x00000009 popad 0x0000000a jmp 00007F995D15D9EBh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F995D15D9F3h 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D1E15h], eax 0x0000001d push 00000000h 0x0000001f add dword ptr [ebp+122D34E8h], edi 0x00000025 add dword ptr [ebp+122D1C4Eh], ebx 0x0000002b call 00007F995D15D9E9h 0x00000030 jno 00007F995D15DA00h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F995D15D9F5h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508BA2 second address: 508BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508BA7 second address: 508BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F995D15D9E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push edx 0x00000019 jg 00007F995D15D9E6h 0x0000001f pop edx 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 push esi 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 508D49 second address: 508D6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, eax 0x0000000a push 00000000h 0x0000000c push 5836A853h 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F995CCAC5A1h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528509 second address: 528531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F995D15D9F3h 0x0000000f je 00007F995D15D9E6h 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528531 second address: 52855F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Eh 0x00000007 jmp 00007F995CCAC5A7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52855F second address: 52856C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F995D15D9EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526523 second address: 526531 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526531 second address: 526535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526535 second address: 52654F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F995CCAC596h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F995CCAC596h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52654F second address: 52656B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5266AA second address: 5266C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F995CCAC5A2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5266C2 second address: 5266C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526C10 second address: 526C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC5A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F995CCAC5A4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526C3C second address: 526C4C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F995D15D9E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526DC6 second address: 526DD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995CCAC59Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526DD6 second address: 526DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995D15D9EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526DE4 second address: 526DEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526F0A second address: 526F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F995D15D9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526F14 second address: 526F1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527089 second address: 5270A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F995D15D9E6h 0x0000000a jmp 00007F995D15D9EAh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5270A2 second address: 5270AF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FB55 second address: 51FB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9F6h 0x00000009 jmp 00007F995D15D9EFh 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FB83 second address: 51FBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F995CCAC596h 0x0000000c popad 0x0000000d jc 00007F995CCAC5A8h 0x00000013 jmp 00007F995CCAC5A0h 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jng 00007F995CCAC596h 0x00000023 popad 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECB14 second address: 4ECB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9F7h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jmp 00007F995D15D9F2h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007F995D15D9F7h 0x0000001a pop edi 0x0000001b jne 00007F995D15D9ECh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52806A second address: 528072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528072 second address: 528078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528078 second address: 528089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 js 00007F995CCAC5A0h 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528383 second address: 528387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528387 second address: 5283C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC5A3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jng 00007F995CCAC59Ch 0x00000013 pushad 0x00000014 jmp 00007F995CCAC5A4h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EAF9B second address: 4EAFA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F995D15D9E6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EAFA7 second address: 4EAFAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52F90C second address: 52F912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E3B9 second address: 52E3BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ECB68 second address: 4ECB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53518A second address: 5351A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F995CCAC5A0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5352E0 second address: 53533C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F995D15D9ECh 0x0000000b jmp 00007F995D15D9F9h 0x00000010 popad 0x00000011 jg 00007F995D15DA19h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F995D15D9EDh 0x0000001f jmp 00007F995D15D9F6h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535595 second address: 53559B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53580C second address: 535810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535810 second address: 535832 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F995CCAC5A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535832 second address: 53583F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F995D15D9E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379E0 second address: 537A01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F995CCAC5A2h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A01 second address: 537A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A11 second address: 537A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A15 second address: 537A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A1B second address: 537A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995CCAC5A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A2F second address: 537A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A33 second address: 537A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jp 00007F995CCAC5B7h 0x00000012 pushad 0x00000013 jmp 00007F995CCAC5A9h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537A61 second address: 537AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007F995D15D9E8h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 or dword ptr [ebp+122D2EB6h], edx 0x00000026 call 00007F995D15D9E9h 0x0000002b push eax 0x0000002c push edx 0x0000002d jne 00007F995D15D9E6h 0x00000033 pop edx 0x00000034 pop eax 0x00000035 push eax 0x00000036 pushad 0x00000037 push ecx 0x00000038 jmp 00007F995D15D9EFh 0x0000003d pop ecx 0x0000003e jl 00007F995D15D9F3h 0x00000044 jmp 00007F995D15D9EDh 0x00000049 popad 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e pushad 0x0000004f push eax 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 pop eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push ebx 0x00000056 pop ebx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537AD3 second address: 537AE4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538056 second address: 53805A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805A second address: 53805E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805E second address: 53806F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F995D15DA00h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5381C5 second address: 5381CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5381CC second address: 5381E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F995D15D9F0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5386DB second address: 5386E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5388A5 second address: 5388AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5388AA second address: 5388B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5389B7 second address: 5389BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538A74 second address: 538A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538B46 second address: 538B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53912B second address: 5391D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F995CCAC5A5h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F995CCAC598h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122DB710h], edi 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F995CCAC598h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d jmp 00007F995CCAC5A1h 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 jbe 00007F995CCAC5A8h 0x0000005b jmp 00007F995CCAC5A2h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5391D0 second address: 5391ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F995D15D9E8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539C36 second address: 539C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539C3A second address: 539C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539C3E second address: 539CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F995CCAC598h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push edi 0x00000025 pushad 0x00000026 mov edi, 413037EFh 0x0000002b je 00007F995CCAC596h 0x00000031 popad 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 mov si, 69A1h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F995CCAC598h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 sub dword ptr [ebp+122D270Ah], ecx 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F995CCAC59Bh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53AE05 second address: 53AE0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2C7 second address: 53D2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F995CCAC596h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03D second address: 53C064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F995D15D9F5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2D8 second address: 53D2DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2DC second address: 53D2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FC33 second address: 53FC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FC37 second address: 53FC3D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542565 second address: 54256B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542A2D second address: 542A45 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995D15D9ECh 0x00000008 jc 00007F995D15D9E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542A45 second address: 542A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542A4A second address: 542A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543A17 second address: 543A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 543A1C second address: 543A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5469E8 second address: 5469EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547A06 second address: 547A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995D15D9F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 542C02 second address: 542C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547AC5 second address: 547AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F995D15D9E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B1B second address: 549B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548D80 second address: 548D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B1F second address: 549B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B23 second address: 549B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548D85 second address: 548D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548D8B second address: 548D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AAC3 second address: 54AB27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b ja 00007F995CCAC598h 0x00000011 pop esi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F995CCAC598h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jne 00007F995CCAC599h 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D370Ah] 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D307Ch] 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F995CCAC59Bh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BB5D second address: 54BB63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54BB63 second address: 54BB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F995CCAC5A7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CB6B second address: 54CBD8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F995D15D9E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F995D15D9F6h 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F995D15D9E8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f add dword ptr [ebp+122D23AFh], edx 0x00000035 push 00000000h 0x00000037 call 00007F995D15D9F7h 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jg 00007F995D15D9E8h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CBD8 second address: 54CBDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DA58 second address: 54DA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54FB1B second address: 54FB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC59Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54FB2A second address: 54FB31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ECB7 second address: 54ECBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551A8B second address: 551A9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551A9E second address: 551B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F995CCAC598h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F995CCAC598h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007F995CCAC598h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000015h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e jmp 00007F995CCAC5A7h 0x00000063 mov dword ptr [ebp+122D34A7h], eax 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56505A second address: 565064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F995D15D9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565341 second address: 56534A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56534A second address: 56534E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56534E second address: 565352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DFB7 second address: 56DFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8A1D second address: 4F8A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57136C second address: 571371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571371 second address: 571376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571376 second address: 57139E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9F7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57139E second address: 5713BB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F995CCAC59Ah 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5713BB second address: 5713C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5713C0 second address: 5713E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F995CCAC5A4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5713E9 second address: 5713F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F995D15D9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5714E0 second address: 57151B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F995CCAC5A6h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F995CCAC5A0h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F995CCAC596h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57151B second address: 57152F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F995D15D9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57152F second address: 571536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575AAD second address: 575ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575ABC second address: 575AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575AC2 second address: 575AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575AC8 second address: 575AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC5A6h 0x00000007 jmp 00007F995CCAC5A4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576380 second address: 57639C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F995D15D9F0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57639C second address: 5763A6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763A6 second address: 5763AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763AC second address: 5763B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763B2 second address: 5763B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763B6 second address: 5763F7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F995CCAC596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F995CCAC5A5h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F995CCAC5A8h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763F7 second address: 5763FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5763FB second address: 576403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576403 second address: 576419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995D15D9F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576C0B second address: 576C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360A4 second address: 5360CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnc 00007F995D15D9E6h 0x00000011 jmp 00007F995D15D9F6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360CC second address: 5360D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F995CCAC596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360D6 second address: 536111 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F995D15D9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d lea eax, dword ptr [ebp+1247BE71h] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F995D15D9E8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov ecx, dword ptr [ebp+122D37AEh] 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536111 second address: 536116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536116 second address: 51FB55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jns 00007F995D15D9EBh 0x00000012 call dword ptr [ebp+122D349Ah] 0x00000018 jng 00007F995D15DA24h 0x0000001e jmp 00007F995D15D9F1h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536768 second address: 5367A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F995CCAC5A2h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F995CCAC5A8h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5367A3 second address: 5367A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5367A7 second address: 536839 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F995CCAC59Ch 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 pushad 0x00000016 jmp 00007F995CCAC5A5h 0x0000001b jng 00007F995CCAC596h 0x00000021 popad 0x00000022 pop edi 0x00000023 pop eax 0x00000024 pushad 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D1CF2h], ecx 0x0000002c mov esi, dword ptr [ebp+122D3782h] 0x00000032 popad 0x00000033 mov edi, dword ptr [ebp+122D346Eh] 0x00000039 popad 0x0000003a call 00007F995CCAC599h 0x0000003f push ebx 0x00000040 jmp 00007F995CCAC5A5h 0x00000045 pop ebx 0x00000046 push eax 0x00000047 push ebx 0x00000048 pushad 0x00000049 jne 00007F995CCAC596h 0x0000004f jng 00007F995CCAC596h 0x00000055 popad 0x00000056 pop ebx 0x00000057 mov eax, dword ptr [esp+04h] 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536839 second address: 536848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536848 second address: 53685B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995CCAC59Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53685B second address: 53685F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536D25 second address: 536D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC59Ah 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jnc 00007F995CCAC5A2h 0x00000012 nop 0x00000013 mov ecx, dword ptr [ebp+122D3762h] 0x00000019 push 00000004h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F995CCAC598h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 jns 00007F995CCAC599h 0x0000003b nop 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F995CCAC5A2h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536D92 second address: 536DA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007F995D15D9E6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537208 second address: 53720C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53750D second address: 537513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537636 second address: 52068D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a xor di, 2302h 0x0000000f lea eax, dword ptr [ebp+1247BE71h] 0x00000015 sub ecx, dword ptr [ebp+122D38BAh] 0x0000001b nop 0x0000001c push edi 0x0000001d jmp 00007F995CCAC59Eh 0x00000022 pop edi 0x00000023 push eax 0x00000024 push ecx 0x00000025 jnp 00007F995CCAC598h 0x0000002b pop ecx 0x0000002c nop 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F995CCAC598h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 jmp 00007F995CCAC5A8h 0x0000004c call dword ptr [ebp+122D2EEFh] 0x00000052 push ecx 0x00000053 push eax 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 pushad 0x00000057 popad 0x00000058 pop eax 0x00000059 pop ecx 0x0000005a jnp 00007F995CCAC5BFh 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52068D second address: 520697 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F995D15D9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A586 second address: 57A594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F995CCAC5A7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57AB42 second address: 57AB48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57AB48 second address: 57AB52 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57AB52 second address: 57AB5C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F995D15DA04h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582472 second address: 58247C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F995CCAC596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58247C second address: 58249A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995D15D9F8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58249A second address: 5824A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5824A1 second address: 5824AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582891 second address: 582895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582895 second address: 5828B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995D15D9F7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5828B2 second address: 5828C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F995CCAC59Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5828C2 second address: 5828D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5828D1 second address: 5828D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582DFE second address: 582E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582F95 second address: 582F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582F99 second address: 582F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581E6E second address: 581E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jc 00007F995CCAC596h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58D12D second address: 58D15C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F995D15D9F3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F995D15D9E6h 0x00000016 jmp 00007F995D15D9EBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58D15C second address: 58D168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F995CCAC596h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BF83 second address: 58BFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F995D15D9EFh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F995D15D9E6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F995D15D9F4h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BFBB second address: 58BFBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BFBF second address: 58BFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BFCC second address: 58BFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC59Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BFDA second address: 58BFE0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58C476 second address: 58C47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BAD2 second address: 58BAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BAD8 second address: 58BAE2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995CCAC596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BAE2 second address: 58BB04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995D15D9F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58BB04 second address: 58BB0E instructions: 0x00000000 rdtsc 0x00000002 js 00007F995CCAC596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CE6F second address: 58CE73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CE73 second address: 58CE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CE7B second address: 58CEB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F9h 0x00000007 jns 00007F995D15D9F8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C68 second address: 596C8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F995CCAC5A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595EC7 second address: 595F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 jc 00007F995D15DA1Ch 0x0000000c pushad 0x0000000d jo 00007F995D15D9E6h 0x00000013 jmp 00007F995D15D9EFh 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F995D15D9F1h 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59603B second address: 59604C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b ja 00007F995CCAC596h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59604C second address: 596050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596050 second address: 596056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596056 second address: 59605B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5961C2 second address: 5961CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5961CB second address: 5961F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jg 00007F995D15D9E6h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5961F0 second address: 5961F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59661F second address: 596637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59677B second address: 596781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5999C5 second address: 5999C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599296 second address: 59929B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599414 second address: 599423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599423 second address: 599428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599428 second address: 599438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F995D15D9E6h 0x0000000a jo 00007F995D15D9E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D7E8 second address: 59D7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D7EC second address: 59D80C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9EEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F995D15D9EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D969 second address: 59D99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F995CCAC5A9h 0x0000000d jmp 00007F995CCAC59Eh 0x00000012 jnp 00007F995CCAC596h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D99F second address: 59D9A9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F995D15D9F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DF39 second address: 59DF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53703A second address: 537044 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995D15D9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537044 second address: 53704F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E084 second address: 59E0B9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F995D15D9EEh 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jc 00007F995D15D9E6h 0x00000019 jmp 00007F995D15D9EEh 0x0000001e pop ecx 0x0000001f push ebx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0B9 second address: 59E0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E22B second address: 59E22F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E22F second address: 59E24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F995CCAC5A3h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF478 second address: 4FF489 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 jg 00007F995D15D9E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4CA9 second address: 5A4CAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4CAE second address: 5A4CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4F94 second address: 5A4FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F995CCAC59Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F995CCAC5A3h 0x00000016 jmp 00007F995CCAC5A0h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FD1 second address: 5A4FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F995D15D9E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FDD second address: 5A4FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FE1 second address: 5A4FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A52BC second address: 5A52CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F995CCAC59Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A52CC second address: 5A52D6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F995D15D9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A55CB second address: 5A5612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F995CCAC5A7h 0x0000000b popad 0x0000000c jne 00007F995CCAC598h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 jmp 00007F995CCAC59Eh 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 pop eax 0x00000023 pushad 0x00000024 popad 0x00000025 je 00007F995CCAC596h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C06 second address: 5A5C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C0A second address: 5A5C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F995CCAC59Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C21 second address: 5A5C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F995D15D9F3h 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F995D15D9ECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C4B second address: 5A5C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C51 second address: 5A5C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C55 second address: 5A5C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5C5F second address: 5A5C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A674C second address: 5A676B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F995CCAC5A7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A676B second address: 5A6775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F995D15D9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABD76 second address: 5ABD7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABD7A second address: 5ABD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995D15D9F1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABD91 second address: 5ABD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABD97 second address: 5ABDBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F995D15D9ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF869 second address: 5AF892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F995CCAC5AAh 0x0000000b jmp 00007F995CCAC5A2h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F995CCAC596h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF892 second address: 5AF896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE9F5 second address: 5AEA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC5A4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F995CCAC5A7h 0x00000011 jmp 00007F995CCAC5A9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEA40 second address: 5AEA44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEE79 second address: 5AEE7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEFC4 second address: 5AEFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F995D15D9F8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B85D5 second address: 5B85E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F995CCAC596h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B85E1 second address: 5B85EB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F995D15D9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B85EB second address: 5B85FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F995CCAC596h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B99E2 second address: 5B99F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F995D15D9E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7866 second address: 5B786D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF050 second address: 5BF054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF054 second address: 5BF081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F995CCAC5A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE22F second address: 5CE239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE239 second address: 5CE23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D29C1 second address: 5D29D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D29D9 second address: 5D29DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D29DD second address: 5D29E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D29E3 second address: 5D29EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D29EA second address: 5D2A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F995D15D9EFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2A06 second address: 5D2A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2A0C second address: 5D2A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F995D15D9EBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2A1E second address: 5D2A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D26D4 second address: 5D26F7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F995D15D9FEh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F995D15D9F6h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D26F7 second address: 5D26FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D26FD second address: 5D2725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9EAh 0x00000009 jmp 00007F995D15D9ECh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jne 00007F995D15D9EEh 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2725 second address: 5D273E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995CCAC5A1h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D273E second address: 5D2753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F995D15D9EBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2753 second address: 5D2757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7CB4 second address: 5D7CBB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D692E second address: 5D6937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6937 second address: 5D6942 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F995D15D9E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E018B second address: 5E0192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0020 second address: 5E0024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0024 second address: 5E0032 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F995CCAC596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0032 second address: 5E0036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9AD2 second address: 5E9AE1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F995CCAC596h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8C64 second address: 5E8C68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8C68 second address: 5E8C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8C6E second address: 5E8C86 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F995D15D9ECh 0x00000008 je 00007F995D15D9EEh 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8DF8 second address: 5E8DFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8DFD second address: 5E8E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8E05 second address: 5E8E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007F995CCAC5C8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F995CCAC5A2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E97DC second address: 5E97E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E97E0 second address: 5E97FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F995CCAC5A4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECFD1 second address: 5ECFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9F4h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7D85 second address: 5F7D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7D89 second address: 5F7D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F995D15D9ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ED97 second address: 60ED9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ED9B second address: 60EDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E246 second address: 60E25D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995CCAC59Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E25D second address: 60E261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E62B second address: 60E645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F995CCAC5A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E645 second address: 60E66E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F995D15D9F1h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007F995D15DA0Dh 0x00000013 jnp 00007F995D15D9EEh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E7D1 second address: 60E7D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611920 second address: 61192A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616EE0 second address: 616EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616EE6 second address: 616EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616FE1 second address: 616FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A029 second address: 61A02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A02F second address: 61A033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A033 second address: 61A03B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612EC4 second address: 612EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612EC8 second address: 612ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612ECC second address: 612EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a push esi 0x0000000b jmp 00007F995CCAC59Eh 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F995CCAC59Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612D61 second address: 612D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F995D15D9F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jg 00007F995D15D9E6h 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 52F892 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 52E1CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 52E526 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 38DA67 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5C4DA7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 52A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 74B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050605D rdtsc

0_2_0050605D

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4268

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050605D rdtsc

0_2_0050605D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00390414 LdrInitializeThunk,

0_2_00390414

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: xProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0055E351 GetSystemTime,GetFileTime,

0_2_0055E351

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559390
Start date and time:	2024-11-20 13:26:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.529111957722914
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'756'608 bytes
MD5:	bd8bd8ac55f48657780d6ff5570f98ce
SHA1:	cd99112e246d966339be39c6b3332eeeac90105c
SHA256:	9fe8f85118b90bf8fdd24659d34a1210ce35ff94fd6f52ff5e7d2dbe1f624d5e
SHA512:	fb876cc6a46a9a4a7bbaa817c6a4ae0e791b55123b17ff5c62ec0a0b630e4fc7d4b0652ce5a4421099d16609231decce2f80921bdc819b8e76d6484f39ea32ee
SSDEEP:	24576:9PIWADOWjlH8wAYY0C68YNUwpaoZ1x7MKsMq+NuThdxQMf16pMABQLJX7RvX7uWR:ZIWADBjxaYYzopph0v+C9vejc/rXd
TLSH:	0AD55B92B54971DFD48E13B499A7CDC2589D07F90B2508C39C2DB6BABDA3CC512F6C28
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ...............................*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6a8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F995CFB26CAh
pmaxsw mm5, qword ptr [ecx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	9bce733d11d7a68839012ffa131da5f1	False	0.9340277777777778	data	7.815000576313311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ywhttfna	0xa000	0x29c000	0x29b000	0fe2b0be56b6a4a3f47d3d871a181d78	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mpyioxor	0x2a6000	0x2000	0x400	e1c52d0886851a8665c6d82a4f625d48	False	0.7421875	data	5.870935239369237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2a8000	0x4000	0x2200	599c962c52bada49d0609e90c9bc019f	False	0.04894301470588235	DOS executable (COM)	0.531757473184582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	07:27:03
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x380000
File size:	2'756'608 bytes
MD5 hash:	BD8BD8AC55F48657780D6FF5570F98CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	4.4%
Signature Coverage:	0.7%
Total number of Nodes:	275
Total number of Limit Nodes:	12

Executed Functions

Function 0050605D Relevance: 1.6, APIs: 1, Instructions: 127
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0050605D

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 06df1848e15507d4e3da0b90adef4e893a4dd90477d761ed64ed167be2aa3d30
Instruction ID: 310c48e8d1b77f1255f868b1ae0b406a333c9cdfc6fc525920593315e1dcf5c4
Opcode Fuzzy Hash: 06df1848e15507d4e3da0b90adef4e893a4dd90477d761ed64ed167be2aa3d30
Instruction Fuzzy Hash: FD416BB254C210EFE311AF19E9416BEFBE9FF85320F22482EE6C483640D37644549BA3

Function 0055B8D7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 0055B9E8
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 0055B9FC

Strings

1002, xrefs: 0055B9B2
.exe, xrefs: 0055B943
.dll, xrefs: 0055B91F

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: c59d660af66dc0570d290648a83a43e4088ddfe102cf545dfd336ba2bb68516d
Instruction ID: 4fb8a37a93e41e781155cde899c61dc99e36b1fe23eaef75832319e8829e5401
Opcode Fuzzy Hash: c59d660af66dc0570d290648a83a43e4088ddfe102cf545dfd336ba2bb68516d
Instruction Fuzzy Hash: AF319C3140424AEFEF21AF50C92DAAD7F75FF48352F108517FE0296121D735AAA8DB52

Function 0055BDDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,0055BD6F,?,00000000,00000000), ref: 0055BE9A
GetModuleHandleA.KERNEL32(00000000,?,?,?,0055BD6F,?,00000000,00000000), ref: 0055BEA8

Strings

.dll, xrefs: 0055BE10

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 8a478261a70fb464429202eafeae6481828a456b8697cb78a9767b23cb91bc72
Instruction ID: 623c05e693aae2be7c5f34bdb3ebf0efbb3a8cb07bc1cadb2d524d54a112e1c6
Opcode Fuzzy Hash: 8a478261a70fb464429202eafeae6481828a456b8697cb78a9767b23cb91bc72
Instruction Fuzzy Hash: D4112E31504606EFFB30AF14C82E7A97EB9BF50347F184617BE0544490D7B5A9ECCA92

Function 0055E737 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(01341914,-11F45FEC), ref: 0055E7B0
GetFileAttributesA.KERNEL32(00000000,-11F45FEC), ref: 0055E7BE

Strings

@, xrefs: 0055E763

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 23839efea845d5e091bb0172db8cfa9d9bdfec226ffcea2665bbe208601fce1e
Instruction ID: 28f53b2afa1989b79401ea5da44c45870726628fbf386de5d7aad277751fcdf7
Opcode Fuzzy Hash: 23839efea845d5e091bb0172db8cfa9d9bdfec226ffcea2665bbe208601fce1e
Instruction Fuzzy Hash: 2D018630510285FAEF289B64C86EB9C7E70FF98307F218166EC0665490C7B04BD9EB41

Function 00508AD7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 00508E60

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 89dc2ca7c8be9595671db00e6b7fc9356dfd10d2c2f4190e16ba98bd262b729e
Instruction ID: f2fa84f77ec2fea0612669a35a1f9f7699a10446bc7eeb7f780ad6d1a13ae459
Opcode Fuzzy Hash: 89dc2ca7c8be9595671db00e6b7fc9356dfd10d2c2f4190e16ba98bd262b729e
Instruction Fuzzy Hash: E54124B250C286AED7118E24D964EBE7FADFB96730F3048AAF481C75C2DA611C499724

Function 0055A7B7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 0055A819

Strings

\\?\, xrefs: 0055A874

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 60b32491d26ea7f50108bc3a8e8eef4e4712e7b67b879311bb5dd8a9a9170f41
Instruction ID: eb22dfecff06052252a3f580118c639647db56bd32c579455fb7020abdadf0a2
Opcode Fuzzy Hash: 60b32491d26ea7f50108bc3a8e8eef4e4712e7b67b879311bb5dd8a9a9170f41
Instruction Fuzzy Hash: 71313D3590020ABFDF219F94CD19B9EBF75BF48716F000266FE00A5060D7729A69EB55

Function 0055BEC6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 0055BF2A

Strings

.dll, xrefs: 0055BEE7

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 20d296cb8014a76e06689d6342a7129adc4cbdd05a6526889b5f3f144d06611b
Instruction ID: c99ded5e05db800961909009e7dd005421d4c6b6639894b2621689b22aeb5878
Opcode Fuzzy Hash: 20d296cb8014a76e06689d6342a7129adc4cbdd05a6526889b5f3f144d06611b
Instruction Fuzzy Hash: 5CF09A71104206AFEF10AF54CC5EAAA3FA4BF68306F108612FE058A056C375D5A8DE22

Function 0055E953 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(01341914,?,?,-11F45FEC,?,?,?,-11F45FEC,?), ref: 0055EA05

Part of subcall function 0055E905: IsBadWritePtr.KERNEL32(?,00000004), ref: 0055E913

CreateFileA.KERNEL32(?,?,?,-11F45FEC,?,?,?,-11F45FEC,?), ref: 0055EA25

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 1f3010483c3cdc73f7757b8c5e9fb745bb9efd9bdae2fd0970d68920f4334f7f
Instruction ID: 1be9b8ec7c156bacb218bd6e81a2a6ffbcb8f8afe9a6a1cca9315f45d2308fc7
Opcode Fuzzy Hash: 1f3010483c3cdc73f7757b8c5e9fb745bb9efd9bdae2fd0970d68920f4334f7f
Instruction Fuzzy Hash: AB11143100424AFBCF269FA0CC2BB9D3E32BF59346F118516FE0524461C7768AB9EB42

Function 0055E2BF Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

GetCurrentProcess.KERNEL32(-11F45FEC), ref: 0055E2CC
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0055E332

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: cd0abef74f2c60c0821b31ad4ca4e3aa4ab221f0cc4891318081f949544771e8
Instruction ID: 646d9bd12771d8c4b526a3f9b2494eaf382f43b7ee4ee7405f8dc906c4f26e54
Opcode Fuzzy Hash: cd0abef74f2c60c0821b31ad4ca4e3aa4ab221f0cc4891318081f949544771e8
Instruction Fuzzy Hash: CC016D3310010BFB8F26AFA4CC1AC9E3F35BF99352B054A16FE4196051C736E569EB62

Function 0055C93E Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 0055C9F3

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 506b9b6c2ded4343ba398567dd01916246158ff9a5a1db379d966d91e230f012
Instruction ID: a76a990a6745cfb0efe3961ff53f0df5bfa737ef841d33a85e069e5e908026aa
Opcode Fuzzy Hash: 506b9b6c2ded4343ba398567dd01916246158ff9a5a1db379d966d91e230f012
Instruction Fuzzy Hash: C3316B71900209BFEB20DFA0DC59FA9BFB8FF48725F208226F901AA191C771A945CB10

Function 0055C15A Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 0055C1DC

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c02f2f7ebe4a6c114a29731c566ef595ecf5ac8d017606736584bb7e26295f94
Instruction ID: 6bb8bd974f7f1afa25f2fcde31cf2bbb931d01d33a57a0df6569123997000351
Opcode Fuzzy Hash: c02f2f7ebe4a6c114a29731c566ef595ecf5ac8d017606736584bb7e26295f94
Instruction Fuzzy Hash: 1C31B175500305BFEF209FA4DC59F99BFB8BF45B25F204226FA10AA0D1D7B2A585CB14

Function 052A0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 052A0DCD

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 58bf38e443062ca6919f0ef365f2cca124a34176dee662fb677a2f66a3c71991
Instruction ID: b13784c7970da95a4f59ae15803f2d6ea3409b1a9995cf1e328db72c8870975c
Opcode Fuzzy Hash: 58bf38e443062ca6919f0ef365f2cca124a34176dee662fb677a2f66a3c71991
Instruction Fuzzy Hash: 982147B6C012599FCB10CF99D884ADEFBF4FF88310F14811AD808AB204C734A540CFA4

Function 052A0D42 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 052A0DCD

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 6835742b6b2f19ad0606e4d338b4a4a3f49ac9926a8986e6e2998246d20d0015
Instruction ID: 87168b24164d350627d273a6fa382c37e61cf2e2b34988e5f10ee4c1c160b53c
Opcode Fuzzy Hash: 6835742b6b2f19ad0606e4d338b4a4a3f49ac9926a8986e6e2998246d20d0015
Instruction Fuzzy Hash: 4B2135BAC016598FCB50CF99D988BDEFBF4FF88310F14811AD909AB244D734A540CBA0

Function 00508A2F Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 00508AB9

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a1298ef7b58ed4d65f40ebde7acfb9d1bad5e5f2d2c983ecb9d17f337099c86c
Instruction ID: 400a8a6fe9001ea76ffc3a6ceefdb206f8c9783f13be0c9fdfd7c7f2711f9bc6
Opcode Fuzzy Hash: a1298ef7b58ed4d65f40ebde7acfb9d1bad5e5f2d2c983ecb9d17f337099c86c
Instruction Fuzzy Hash: D1F04FBB30D2157DE200CA55AE90EFFBB9CEBC97B0B308C2BF585C6541C6214D496675

Function 052A1509 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 052A1580

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: ce27a60b2ccf1389a004fbe0475b4864d6af92eb3fc94f3e4e84eb7bf3681eb4
Instruction ID: 4c65e7ddb9b38a55f64590237c10d8fa4db72d6f914ab98dacf909364b4eee85
Opcode Fuzzy Hash: ce27a60b2ccf1389a004fbe0475b4864d6af92eb3fc94f3e4e84eb7bf3681eb4
Instruction Fuzzy Hash: D92103B69002498FDB10CF9AC584BDEBBF4FF48320F14802AE519A3250D378AA44CFA1

Function 052A1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 052A1580

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: c967a53aa29d16c91bcb6a25235276f9ea00c2f5de291baf0800de7ac22bcf8f
Instruction ID: 45c5857a780c3106268082f3a21b8d357cc129aba2ceba3e0e001ce318f7ca8d
Opcode Fuzzy Hash: c967a53aa29d16c91bcb6a25235276f9ea00c2f5de291baf0800de7ac22bcf8f
Instruction Fuzzy Hash: B511E4B59002499FDB10CF9AC584BDEFBF4FF48320F108029E559A3250D778AA44CFA5

Function 0055F48B Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11F45FEC), ref: 0055F512

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: 13c0874357ad93fe310a89b87e204c43b880e2638ca0110027fcdd998fdcc838
Instruction ID: 56c1c0fa72d7df03a874c1abc8597ee323a094e73066b904dc6cefd834856961
Opcode Fuzzy Hash: 13c0874357ad93fe310a89b87e204c43b880e2638ca0110027fcdd998fdcc838
Instruction Fuzzy Hash: E311A57250010AFBCF226FA4DC2AC9F3E66BF98352B004522FE1155061D736857AEB62

Function 0055F273 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d6d011c6b5b6c628f5da3e56f7a44a403c6f5994e61e030e7cc6dd1587d0464b
Instruction ID: d516d1a2cab9a572c29cac2ddac79678e5bb5b347af9996a7ea595c1066fa914
Opcode Fuzzy Hash: d6d011c6b5b6c628f5da3e56f7a44a403c6f5994e61e030e7cc6dd1587d0464b
Instruction Fuzzy Hash: B711A17A40020AEFCF11AF94CD2EA9E3F75BF88306F004522FD0186061C379C969EB61

Function 052A1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 052A1367

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: e00b5ffc29753604d1bbeb192800e2920c89bb18719607ca826924d4aebd45d1
Instruction ID: 84582d7b0ab6b80052a143f7ed663ec2c750280d14b25cc03e92d92d74abec04
Opcode Fuzzy Hash: e00b5ffc29753604d1bbeb192800e2920c89bb18719607ca826924d4aebd45d1
Instruction Fuzzy Hash: EC1103B5800259CFDB10DF9AC545BEEFBF8EF48320F24846AD518A3650D778A944CFA5

Function 052A1301 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 052A1367

Memory Dump Source

Source File: 00000000.00000002.2265031710.00000000052A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52a0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 1842968722212a36efa0b0285a717d52b802dc4240d1a56a1b38daed5e6c816a
Instruction ID: 37dbc69f4289ee00c040c9be6d20e25b14819e226a91b60cc058d168bcaee120
Opcode Fuzzy Hash: 1842968722212a36efa0b0285a717d52b802dc4240d1a56a1b38daed5e6c816a
Instruction Fuzzy Hash: D41122B6800249CFDB10DF9AC545BEEBBF4EF08320F24842AD528A3640D778A944CFA5

Function 00508A48 Relevance: 1.5, APIs: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 00508AB9

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 854a5abe6c3cb3388852e966a39a19baae399cd527ca4aa962611f5c138136e3
Instruction ID: cb923571ebd11fcb46a681f78dcc516220a41154db4debcde741aeb36694c67d
Opcode Fuzzy Hash: 854a5abe6c3cb3388852e966a39a19baae399cd527ca4aa962611f5c138136e3
Instruction Fuzzy Hash: 92F090B720D2157EE200DA45AE80EBFBB9CEB857B0B304C2BF585C7541C1224C495B75

Function 00508DC1 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0457E826,?,3C61FC5C), ref: 00508E0D

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd15e004e9c728bad6170a29ad4ab7621167e1fb17c06055d6c77ca73f7c8c3e
Instruction ID: b3ab47fdd4d0d36943cba5f9001744f638a34e977e9cef5523d0b7e5ec1d7786
Opcode Fuzzy Hash: cd15e004e9c728bad6170a29ad4ab7621167e1fb17c06055d6c77ca73f7c8c3e
Instruction Fuzzy Hash: E801263260C20B9FC301EE34C948FBCBFAAFB55700F250A5DE0858B6C5DE225D848B15

Function 0055EB57 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11F45FEC,?,?,0055C886,?,?,00000400,?,00000000,?,00000000), ref: 0055EBC3

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: cce523fd5826f0913fff23df0faa715f3b9bd1739e3e4c11d143226032bee6c1
Instruction ID: 21d4194f8bc482c8b8f9de87b43b84213423811d631360416a4d05b03e157944
Opcode Fuzzy Hash: cce523fd5826f0913fff23df0faa715f3b9bd1739e3e4c11d143226032bee6c1
Instruction Fuzzy Hash: C0F0193610410BEFCF166F94D81AD8E3F66FF98362F004512FE0659065C736C5A9EB62

Function 00508DD4 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0457E826,?,3C61FC5C), ref: 00508E0D

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b7537efdc5626dcf02e4df36cf166969d26f65c7238cbfad7606e5283df95b78
Instruction ID: f473654ef7a0377f12207abd34224ad7ed55b1f29be3ea33fb8094c7dea69713
Opcode Fuzzy Hash: b7537efdc5626dcf02e4df36cf166969d26f65c7238cbfad7606e5283df95b78
Instruction Fuzzy Hash: B9F0283210C64B8FC311DE38C944ABC7FAAFB55700B250A5DE0C58B686DD265C848B29

Function 00508E02 Relevance: 1.5, APIs: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(0457E826,?,3C61FC5C), ref: 00508E0D

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8041c0a42b76c21a9d4db83b26c61be76b6bfd342254dc70114f78d9b036583a
Instruction ID: 3046fd9112c063444f741b536115bfe08e71a8cf326f77b83484d7ed8c91b713
Opcode Fuzzy Hash: 8041c0a42b76c21a9d4db83b26c61be76b6bfd342254dc70114f78d9b036583a
Instruction Fuzzy Hash: 78F0E53120D2479FD351DA34DC5AB7D3FAAEB863147314AADE089CB287DD269C468724

Function 00508A6F Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 00508AB9

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd614aede04a234e4c8fe13c86b9098c4878e5d21f9be6db6451c34dff7bedcb
Instruction ID: d43d08a4a2334c2b7891c71ed0d95f0634ee29303196743f15b59dfde6fd2295
Opcode Fuzzy Hash: dd614aede04a234e4c8fe13c86b9098c4878e5d21f9be6db6451c34dff7bedcb
Instruction Fuzzy Hash: 41F0A032309305EED720EF6489C5A7E7FA0BB95775F284A1AD8E2D76D2CA2144009AD9

Function 00508C89 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00508CBF

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 97ca521b9f667e327b8dfcbcb597f4207e02b38ddbd9ad0701d732ec03bae037
Instruction ID: b9c3800b7218d35ad9690992035c5a6b8491b52939641b893a48e2036e2ce014
Opcode Fuzzy Hash: 97ca521b9f667e327b8dfcbcb597f4207e02b38ddbd9ad0701d732ec03bae037
Instruction Fuzzy Hash: 9BD02BD300DB5134F10127560B45EBEAEBA7741230E21445EB2C01C0C19C7204041139

Function 00508CA7 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00508CBF

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5e1b4fa717275b62461556a17e97f407e61d11a1ffd3a5d0532c062f5c970d40
Instruction ID: 1a78719b825ac79596c17154bccff98bee076f89a8c7b66aac8102f8aa4597cb
Opcode Fuzzy Hash: 5e1b4fa717275b62461556a17e97f407e61d11a1ffd3a5d0532c062f5c970d40
Instruction Fuzzy Hash: 8AC022A3501A1E26F11013284C81FADB7AAFFC8440F504A04E24407182C8200C918324

Function 00508AA8 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 00508AB9

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: aafb752aeef096e6a6718dc9c688a8af0da688b8a9e0a563b8204711e5ccec2c
Instruction ID: 5b2877cfe7f9854ddbc023de920e079c8734fe1eba1ebd9a838a5a2c55a2a463
Opcode Fuzzy Hash: aafb752aeef096e6a6718dc9c688a8af0da688b8a9e0a563b8204711e5ccec2c
Instruction Fuzzy Hash: 1CC080F035535129D214F7380C5AFBE7F0457D0531F18055DE5401B1C18D52D4004671

Function 0038E3CA Relevance: 1.3, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0038E7C0

Memory Dump Source

Source File: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dc9d0e0897ad78dcf8b29be54d9a5c7907e7c0b9b3d9b3903d4de2cd205f5493
Instruction ID: f3be854b279a2b1f5ee72ef5368f6f7758efe9c71155396bc3551d23127424c7
Opcode Fuzzy Hash: dc9d0e0897ad78dcf8b29be54d9a5c7907e7c0b9b3d9b3903d4de2cd205f5493
Instruction Fuzzy Hash: 471157B7608345CBE7407EB98C087BF7BE9DB80320F25056EDA52C3B80D6728805CB42

Function 0055A3D5 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 0055A439

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d2bd3bacd29c6c18c2985c0eda9891d2389954af61666391bf20d78ef9fa71ad
Instruction ID: 4238d19feff1f71f5644f5dd1d5189fada75153f13b960dbd29124f4a5ae985f
Opcode Fuzzy Hash: d2bd3bacd29c6c18c2985c0eda9891d2389954af61666391bf20d78ef9fa71ad
Instruction Fuzzy Hash: 9101283160011DFFCF219FA4CC08DCEBF76FF48345F004262A900A4061E7728629DB61

Function 0055CF58 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

CloseHandle.KERNELBASE(0055C91B,-11F45FEC,?,?,0055C91B,?), ref: 0055CF96

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: cc8d71a5ad6d00e3f7cd0f5a8502eb87838b1fe172f2dea6381aad7a23195c24
Instruction ID: a376761f3cae044432142b4da5b7b8b7e98b5d591daed8e58c03eda5d19e9cfb
Opcode Fuzzy Hash: cc8d71a5ad6d00e3f7cd0f5a8502eb87838b1fe172f2dea6381aad7a23195c24
Instruction Fuzzy Hash: 44E0DF22204603AACE20BAB8C82FC4E3F29BFE0756B000223BD0285455DA6AD089D622

Function 0055C01D Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,0055A0A3,?,?), ref: 0055C023

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4fda17e2d6a0940b34406fc591f1ba25bf39afcefe3301bdd19aca28f5782d25
Instruction ID: 9ea10e5edaf485e9c4d6c02d89626b7199527dc7f0db831e0eec9eef87d244aa
Opcode Fuzzy Hash: 4fda17e2d6a0940b34406fc591f1ba25bf39afcefe3301bdd19aca28f5782d25
Instruction Fuzzy Hash: 6CB09231000909BBCF01BF61DC0AC4DBF69BFA6399B008121B945884219B72EA659F98

Non-executed Functions

Function 00502000 Relevance: 4.4, Strings: 3, Instructions: 603COMMON

Download Yara Rule

Strings

0k{O, xrefs: 005021DA
9Ze, xrefs: 00502419
n]jj, xrefs: 005023F5

Memory Dump Source

Source File: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID: 0k{O$9Ze$n]jj
API String ID: 0-311306182
Opcode ID: c0bcbe8fd11abf697ab6da42a7130e8e143e6f271be63bcaa6215c495c47a0b6
Instruction ID: 3a760fdfe1cba547f51c72c799a076dc4f6d2803f89f31209d6972d1ccf09e3d
Opcode Fuzzy Hash: c0bcbe8fd11abf697ab6da42a7130e8e143e6f271be63bcaa6215c495c47a0b6
Instruction Fuzzy Hash: C712F5B350C6049FD308AF29EC8567AF7E5EF94720F1A4A3DE6C5C3784EA3598408697

Function 0055E351 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

GetSystemTime.KERNEL32(?,-11F45FEC), ref: 0055E386
GetFileTime.KERNEL32(?,?,?,?,-11F45FEC), ref: 0055E3C9

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: 9644d5dca96169f339c7c6ec15e5bad945e067bd321e65694377ff89f1f48a7f
Instruction ID: 522472eef5ffee7e9f29c0b2896586fe34a2290c2544a0fb509baa91fb680af8
Opcode Fuzzy Hash: 9644d5dca96169f339c7c6ec15e5bad945e067bd321e65694377ff89f1f48a7f
Instruction Fuzzy Hash: 19017832200046FBCF265F58D81EC8E3F35FFE5722B014622F8014A060CB72E9A5DB61

Function 0055F20F Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 0055F256

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 11c7b02e440c036a1fc09febee889447b95cef3f614bfe8698b8ec2c5f8c23bd
Instruction ID: 5cfd4c30f3fc75303567822241884c04963ccae620cc7186916ae8b4266df748
Opcode Fuzzy Hash: 11c7b02e440c036a1fc09febee889447b95cef3f614bfe8698b8ec2c5f8c23bd
Instruction Fuzzy Hash: 9BF01C7A60010AFFCF01CF98DA4498C7F72FF18305F108126F90596111D3B69A65EF40

Function 00528574 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d42d31f64b9746bc1b441e8830aeba5d1a98d1861b79e4fa638243a4362eea
Instruction ID: ee79ea17df9142d0b65188649c368cdcb523c3f5c423598b4d588083490bd2a4
Opcode Fuzzy Hash: d8d42d31f64b9746bc1b441e8830aeba5d1a98d1861b79e4fa638243a4362eea
Instruction Fuzzy Hash: EB3187B250C304EFE301BF29DC856AABBE5EF58310F05892DD6D483A14EB31A4908B97

Function 00390414 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a70e72f071c1a271b17f512880a15509e4d3f5a770506f7fcebb8ea181cabc
Instruction ID: c50290d875045aa799a77a62b8a4e6337fddc25a2e7c3e1a6c082bce1cda9c3c
Opcode Fuzzy Hash: 93a70e72f071c1a271b17f512880a15509e4d3f5a770506f7fcebb8ea181cabc
Instruction Fuzzy Hash: 72118CB0408B0ADFDB15AF15D495ABFB7F8EB81350F25852DC88682900D3720895CF57

Function 0055D887 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0055A204: GetCurrentThreadId.KERNEL32 ref: 0055A213

Part of subcall function 0055E905: IsBadWritePtr.KERNEL32(?,00000004), ref: 0055E913

wsprintfA.USER32 ref: 0055D8CD
LoadImageA.USER32(?,?,?,?,?,?), ref: 0055D991

Strings

%8x, xrefs: 0055D95B, 0055D98E
%8x, xrefs: 0055D8C8, 0055D8CB

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: 09ffa5c67f502fa44e8d7c2a9f224f3eb3480ea9ef7a9e1b08b8569495768545
Instruction ID: 184630d03ee844cddb862ad29f2ec90a7d1056bfe57ac768e61fd4497436043e
Opcode Fuzzy Hash: 09ffa5c67f502fa44e8d7c2a9f224f3eb3480ea9ef7a9e1b08b8569495768545
Instruction Fuzzy Hash: 7A31147290010AFBCF219F94DC09EAEBF79FF89711F108126FA11A61A0D7719A61DB61

Function 0055E458 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(01341914,00004020,00000000,-11F45FEC), ref: 0055E545

Strings

@, xrefs: 0055E484

Memory Dump Source

Source File: 00000000.00000002.2262998141.0000000000552000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.2262575514.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262596275.0000000000382000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262613033.0000000000386000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262632482.000000000038A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262655780.0000000000396000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262753126.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262770126.00000000004E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000502000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262795963.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262834379.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262852071.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262870602.0000000000524000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262887560.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262903076.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262923295.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262945825.000000000053C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262961968.000000000053D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262977637.0000000000540000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263018662.0000000000560000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263035061.0000000000562000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263051942.0000000000563000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263068292.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263088232.0000000000579000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263104385.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263120285.000000000057F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263139107.0000000000584000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263163751.000000000058F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263182771.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263199705.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263216183.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263232813.00000000005AF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263250176.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263264847.00000000005B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263281892.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000610000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263321112.0000000000616000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263359786.0000000000626000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2263377834.0000000000628000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 99c33bdd32abc5ed50c7a178cf47a85156f955da4eccd77e5871ee9dc60d20f0
Instruction ID: 7d6ba1b9432668f856b4c9f03ea911279da463ee921aaa3bca7446714d928bda
Opcode Fuzzy Hash: 99c33bdd32abc5ed50c7a178cf47a85156f955da4eccd77e5871ee9dc60d20f0
Instruction Fuzzy Hash: A73189B1500205EFDF29CF44C85978EBFB1FF08315F10862AE95667660D371A6A9CB90

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 4796, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 4796, Parent PID: 1028COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 0050605D Relevance: 1.6, APIs: 1, Instructions: 127
libraryCOMMON

Function 0055B8D7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 0055BDDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 0055E737 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00508AD7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Function 0055A7B7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 0055BEC6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 0055E953 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 0055E2BF Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 0055C93E Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 0055C15A Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 052A0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 052A0D42 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON