Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561395
MD5:	a4ccc1e6f4894f4832ff349ee223714f
SHA1:	c1863ef0b3b70c0210e30bac674ccd04b0bc5857
SHA256:	f7a868b76e3f413f7cbeafd75c889febb45650ab6c963449f0c1d7ccc833c3b8
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7696 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A4CCC1E6F4894F4832FF349EE223714F)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F90A7 CryptVerifySignatureA,

0_2_004F90A7

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2190546822.00000000046D0000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A8202	0_2_004A8202
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A435E	0_2_004A435E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A4BD5	0_2_004A4BD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DDDC	0_2_0032DDDC

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004F409C appears 35 times

Source: file.exe, 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: ,RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2761728 > 1048576

Source: file.exe

Static PE information: Raw size of teifcfsu is bigger than: 0x100000 < 0x29c400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.320000.0.unpack :EW;.rsrc:W;.idata :W;teifcfsu:EW;cxpiqsak:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2a85fb should be: 0x2ac6e1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: teifcfsu
Source: file.exe	Static PE information: section name: cxpiqsak
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B10BB push esi; mov dword ptr [esp], eax	0_2_004B10C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B10BB push 776AD452h; mov dword ptr [esp], ebx	0_2_004B10CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A370E push ecx; mov dword ptr [esp], 5E379B91h	0_2_004A373D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A370E push ebp; mov dword ptr [esp], 56F1A8E7h	0_2_004A376E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A370E push edi; mov dword ptr [esp], edx	0_2_004A37AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A370E push eax; mov dword ptr [esp], edx	0_2_004A37CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A370E push 6121F141h; mov dword ptr [esp], eax	0_2_004A3839
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032EC69 push edx; mov dword ptr [esp], 46214A4Ah	0_2_0032F94A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032EC69 push 5CC570BBh; mov dword ptr [esp], eax	0_2_0032F983
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A6042 push 6810E7BAh; mov dword ptr [esp], ebp	0_2_004A6233
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A706F push ebx; ret	0_2_004A707E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B0063 push 1169B800h; mov dword ptr [esp], eax	0_2_004B089C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B2074 push 2E9A4C1Ch; mov dword ptr [esp], edi	0_2_004B2079
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B000E push 78CF5141h; mov dword ptr [esp], ecx	0_2_004B36B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B100E push 2AA13541h; mov dword ptr [esp], edi	0_2_004B4414
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B7004 push 4E115C74h; mov dword ptr [esp], eax	0_2_004B711F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B701B push esi; mov dword ptr [esp], ecx	0_2_004B7035
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032D067 push 7D980C39h; mov dword ptr [esp], esi	0_2_0032D043
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00586036 push 4A618942h; mov dword ptr [esp], eax	0_2_0058604E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529029 push 63771DFCh; mov dword ptr [esp], edx	0_2_0052904A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529029 push ecx; mov dword ptr [esp], eax	0_2_00529074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529029 push 1B854726h; mov dword ptr [esp], ebx	0_2_005290D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A00CB push ebx; mov dword ptr [esp], ecx	0_2_004A00CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A00CB push 555632E6h; mov dword ptr [esp], esi	0_2_004A00D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A00CB push 7979FEA1h; mov dword ptr [esp], ebp	0_2_004A00FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003320BC push 4F469400h; mov dword ptr [esp], edx	0_2_003320D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B10ED push ebp; mov dword ptr [esp], eax	0_2_004B4797
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B50F2 push ebx; mov dword ptr [esp], 5FEF9100h	0_2_005B511F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A40FD push ecx; mov dword ptr [esp], edi	0_2_004A410E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A40FD push edx; mov dword ptr [esp], esi	0_2_004A413C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A40FD push ecx; mov dword ptr [esp], 68837005h	0_2_004A4150

Source: file.exe

Static PE information: section name: entropy: 7.771586120312369

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32E54A second address: 32E54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4371 second address: 4A4375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3593 second address: 4A3597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3597 second address: 4A35B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F1954E883D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F1954E883D8h 0x00000012 push ecx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3723 second address: 4A3728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3D07 second address: 4A3D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A69E1 second address: 4A69F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a je 00007F1954C8B6E6h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A69F2 second address: 4A69F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A69F8 second address: 4A6A7C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1954C8B6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F1954C8B6E8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push ebx 0x00000028 mov ecx, dword ptr [ebp+122D3B2Ah] 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F1954C8B6E8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D349Bh], eax 0x00000051 call 00007F1954C8B6E9h 0x00000056 jmp 00007F1954C8B6EBh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F1954C8B6EDh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6A7C second address: 4A6A86 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1954E883DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6A86 second address: 4A6AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F1954C8B6EAh 0x0000000f mov eax, dword ptr [eax] 0x00000011 push ecx 0x00000012 jmp 00007F1954C8B6F0h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F1954C8B6F1h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6BD5 second address: 4A6BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6BDD second address: 4A6BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6BE1 second address: 4A6C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push edx 0x0000000b call 00007F1954E883DAh 0x00000010 pop edx 0x00000011 pop edx 0x00000012 push 00000000h 0x00000014 or ecx, dword ptr [ebp+122D3CC2h] 0x0000001a push 36205264h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1954E883DAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6C12 second address: 4A6C20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F1954C8B6ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6C20 second address: 4A6C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 362052E4h 0x0000000c mov ecx, dword ptr [ebp+122D3322h] 0x00000012 push 00000003h 0x00000014 add dword ptr [ebp+122D21C5h], ecx 0x0000001a je 00007F1954E883DCh 0x00000020 mov ecx, dword ptr [ebp+122D3C52h] 0x00000026 push 00000000h 0x00000028 sub cx, E600h 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F1954E883D8h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 call 00007F1954E883D9h 0x0000004e push edi 0x0000004f push esi 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6C7C second address: 4A6CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F1954C8B6ECh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 jmp 00007F1954C8B6EDh 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6CA6 second address: 4A6CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F1954E883DCh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6CC4 second address: 4A6CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6CC8 second address: 4A6CE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6CE1 second address: 4A6D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F1954C8B6E6h 0x00000009 jno 00007F1954C8B6E6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pop eax 0x00000013 mov dl, 71h 0x00000015 and dh, FFFFFF81h 0x00000018 lea ebx, dword ptr [ebp+1244C872h] 0x0000001e mov edx, dword ptr [ebp+122D1CFBh] 0x00000024 push eax 0x00000025 jc 00007F1954C8B6F4h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6D10 second address: 4A6D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6D98 second address: 4A6E07 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1954C8B6E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 4B62EA8Ah 0x00000011 push ebx 0x00000012 xor dword ptr [ebp+122D349Bh], edi 0x00000018 pop edi 0x00000019 push 00000003h 0x0000001b mov edx, dword ptr [ebp+122D3C62h] 0x00000021 push 00000000h 0x00000023 jmp 00007F1954C8B6EFh 0x00000028 push 00000003h 0x0000002a jnl 00007F1954C8B6FBh 0x00000030 call 00007F1954C8B6E9h 0x00000035 pushad 0x00000036 jl 00007F1954C8B6ECh 0x0000003c jns 00007F1954C8B6E6h 0x00000042 push eax 0x00000043 push edx 0x00000044 jp 00007F1954C8B6E6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E07 second address: 4A6E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F1954E883F0h 0x0000000e pushad 0x0000000f jmp 00007F1954E883E2h 0x00000014 jnc 00007F1954E883D6h 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 jl 00007F1954E883E3h 0x00000026 jmp 00007F1954E883DDh 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E4B second address: 4A6E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E4F second address: 4A6E69 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1954E883D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1954E883DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E69 second address: 4A6E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E6D second address: 4A6E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6E77 second address: 4A6E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495AC0 second address: 495AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C635F second address: 4C6365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6365 second address: 4C6369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6369 second address: 4C636D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C65F8 second address: 4C6612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C67B6 second address: 4C67BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6A6A second address: 4C6A7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954E883DAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6A7A second address: 4C6A86 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1954C8B6EEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C4FE second address: 49C502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C78A4 second address: 4C78A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01F second address: 4CA024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA024 second address: 4CA02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02A second address: 4CA03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a je 00007F1954E883D6h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03F second address: 4CA043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA232 second address: 4CA236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA236 second address: 4CA26C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jnp 00007F1954C8B6E6h 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1954C8B6F9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA26C second address: 4CA290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA290 second address: 4CA29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1954C8B6E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA29B second address: 4CA2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1954E883D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA2A5 second address: 4CA2F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jno 00007F1954C8B6FEh 0x00000014 jnc 00007F1954C8B6F1h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA463 second address: 4CA469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA469 second address: 4CA46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2B79 second address: 4D2B8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c jnp 00007F1954E883DEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2B8D second address: 4D2B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4AA1 second address: 4D4AA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5255 second address: 4D5291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1954C8B6F3h 0x0000000c jp 00007F1954C8B6E6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007F1954C8B6F5h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D5291 second address: 4D52BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 js 00007F1954E883D6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007F1954E883E3h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D57CC second address: 4D57D2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D58C0 second address: 4D58C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6313 second address: 4D6318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D63E4 second address: 4D63E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D63E8 second address: 4D63EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D64BA second address: 4D64EB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1954E883D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1954E883E3h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+124666B5h], ecx 0x00000019 xchg eax, ebx 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jc 00007F1954E883D6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D64EB second address: 4D64EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D64EF second address: 4D6511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1954E883E8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7C30 second address: 4D7C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9015 second address: 4D9019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9019 second address: 4D902D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0123 second address: 4E018E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F1954E883E0h 0x0000000e nop 0x0000000f jp 00007F1954E883DBh 0x00000015 xor bx, 4782h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F1954E883D8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D34CCh], eax 0x0000003c push 00000000h 0x0000003e jc 00007F1954E883DCh 0x00000044 mov dword ptr [ebp+122D2AAFh], ecx 0x0000004a push eax 0x0000004b pushad 0x0000004c pushad 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f jng 00007F1954E883D6h 0x00000055 popad 0x00000056 pushad 0x00000057 jp 00007F1954E883D6h 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB020 second address: 4DB024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBAE6 second address: 4DBAEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC4C4 second address: 4DC4D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DBAEA second address: 4DBAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC4D2 second address: 4DC4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC4D6 second address: 4DC4E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2FE8 second address: 4E2FF2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1954C8B6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC4E4 second address: 4DC4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2FF2 second address: 4E3065 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1954C8B6EBh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F1954C8B6E8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a je 00007F1954C8B6E6h 0x00000030 push 00000000h 0x00000032 jg 00007F1954C8B6ECh 0x00000038 xchg eax, esi 0x00000039 jmp 00007F1954C8B6F8h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jns 00007F1954C8B6E8h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E5 second address: 4E50E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3283 second address: 4E328A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E41E0 second address: 4E4204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F1954E883DBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jne 00007F1954E883D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E9 second address: 4E50ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E328A second address: 4E328F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50ED second address: 4E5171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F1954C8B6EEh 0x0000000e jmp 00007F1954C8B6F0h 0x00000013 popad 0x00000014 nop 0x00000015 mov ebx, dword ptr [ebp+122D3262h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F1954C8B6E8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000017h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov edi, dword ptr [ebp+122D31BEh] 0x0000003d push 00000000h 0x0000003f and ebx, dword ptr [ebp+1246715Ch] 0x00000045 xchg eax, esi 0x00000046 jns 00007F1954C8B6FAh 0x0000004c push eax 0x0000004d jbe 00007F1954C8B6F8h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5171 second address: 4E5175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5175 second address: 4E5179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E52C2 second address: 4E52D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954E883DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6335 second address: 4E63C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop esi 0x00000008 popad 0x00000009 nop 0x0000000a jmp 00007F1954C8B6EEh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 or dword ptr [ebp+1247AE39h], eax 0x0000001d mov dh, 9Ah 0x0000001f popad 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F1954C8B6E8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 js 00007F1954C8B6EBh 0x00000047 xor bx, 7267h 0x0000004c mov eax, dword ptr [ebp+122D1585h] 0x00000052 movsx ebx, dx 0x00000055 push FFFFFFFFh 0x00000057 mov bl, A9h 0x00000059 nop 0x0000005a jmp 00007F1954C8B6EDh 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F1954C8B6F1h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E71AD second address: 4E71B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E71B1 second address: 4E71B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E82FB second address: 4E8301 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA32C second address: 4EA34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1954C8B6F3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F1954C8B6E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB473 second address: 4EB477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB477 second address: 4EB47D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA4CC second address: 4EA4EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1954E883E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC511 second address: 4EC52E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954C8B6EBh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jc 00007F1954C8B6E6h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED4AB second address: 4ED4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883E4h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F1954E883DBh 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC52E second address: 4EC545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954C8B6F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED4D7 second address: 4ED51A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 cld 0x00000008 mov dword ptr [ebp+12468DF8h], esi 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D2FCFh], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F1954E883D8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F1954E883DBh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC545 second address: 4EC5E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c movzx edi, di 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F1954C8B6E8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 jnl 00007F1954C8B6E8h 0x0000003d mov eax, dword ptr [ebp+122D1569h] 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F1954C8B6E8h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 0000001Bh 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d and edi, dword ptr [ebp+122D3C3Ah] 0x00000063 push FFFFFFFFh 0x00000065 mov dword ptr [ebp+122D3480h], eax 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC5E0 second address: 4EC5EA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1954E883D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE670 second address: 4EE68A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1954C8B6E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1954C8B6EAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC5EA second address: 4EC608 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1954E883D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1954E883DFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE68A second address: 4EE68E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF58B second address: 4EF595 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1954E883DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF595 second address: 4EF5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnp 00007F1954C8B6E8h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B698 second address: 48B6A2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1954E883D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE01E second address: 4FE02A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1954C8B6E6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE191 second address: 4FE1AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954E883E5h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504CFD second address: 504D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504D01 second address: 504D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F1954E883DFh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504D21 second address: 504D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954C8B6EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504D33 second address: 504D60 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F1954E883E5h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F1954E883D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504D60 second address: 504D7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504D7C second address: 504D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1954E883D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504E8B second address: 504E9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1954C8B6EBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B813 second address: 50B828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jne 00007F1954E883D8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B828 second address: 50B82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F70C second address: 50F718 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1954E883D6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F718 second address: 50F73E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F1954C8B6F8h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50F73E second address: 50F746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497521 second address: 497525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5123E7 second address: 5123EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCDAB second address: 4DCDE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, F974h 0x0000000f mov ecx, 7EE86677h 0x00000014 lea eax, dword ptr [ebp+12482B3Ch] 0x0000001a mov edx, esi 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 jmp 00007F1954C8B6F7h 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCDE3 second address: 4DCDED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F1954E883D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCDED second address: 4DCDF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DCDF1 second address: 4DCE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F1954E883DCh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD360 second address: 4DD377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD427 second address: 4DD42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD42B second address: 4DD42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD42F second address: 4DD479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954E883DAh 0x0000000b popad 0x0000000c xor dword ptr [esp], 3FAD0CC4h 0x00000013 mov edx, dword ptr [ebp+122D21A1h] 0x00000019 call 00007F1954E883D9h 0x0000001e jmp 00007F1954E883E0h 0x00000023 push eax 0x00000024 push eax 0x00000025 ja 00007F1954E883D8h 0x0000002b pop eax 0x0000002c mov eax, dword ptr [esp+04h] 0x00000030 push ebx 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD479 second address: 4DD48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F1954C8B6E8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD48B second address: 4DD491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD590 second address: 4DD59B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F1954C8B6E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD65D second address: 4DD662 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDFD9 second address: 4DDFFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F1954C8B6EEh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ebx 0x00000013 js 00007F1954C8B6ECh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DDFFD second address: 4DE00B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE00B second address: 4DE01A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F1954C8B6E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0B9 second address: 4DE109 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F1954E883DEh 0x00000012 lea eax, dword ptr [ebp+12482B80h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F1954E883D8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jnl 00007F1954E883D8h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE109 second address: 4DE10E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE10E second address: 4DE13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb cl, FFFFFFA1h 0x0000000d lea eax, dword ptr [ebp+12482B3Ch] 0x00000013 mov dx, CD5Bh 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1954E883E7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE13F second address: 4DE145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE145 second address: 4DE149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51602A second address: 516055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6EDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F1954C8B6EDh 0x00000014 jl 00007F1954C8B6E6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516055 second address: 516075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E6h 0x00000007 jl 00007F1954E883E2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5161AA second address: 5161B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51638B second address: 51639E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51639E second address: 5163A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51651F second address: 51653A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F1954E883E5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516860 second address: 516866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516866 second address: 51686A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51686A second address: 516870 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51BEE8 second address: 51BEED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C317 second address: 51C323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C5C8 second address: 51C5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C5CE second address: 51C5EB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1954C8B6E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C5EB second address: 51C5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jns 00007F1954E883D6h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C5F8 second address: 51C5FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CA3A second address: 51CA48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CA48 second address: 51CA6B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1954C8B6ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1954C8B6F3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D224 second address: 51D229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52317E second address: 52318D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F1954C8B6E6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52318D second address: 5231B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1954E883E4h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F1954E883D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231B4 second address: 5231B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5231B8 second address: 5231D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jno 00007F1954E883D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1954E883E4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521EDA second address: 521EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52249D second address: 5224A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5224A1 second address: 5224BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6F6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52260A second address: 522610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522610 second address: 522614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522614 second address: 52262E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1954E883DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F1954E883D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52262E second address: 522632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521B91 second address: 521BBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1954E883D6h 0x00000008 jmp 00007F1954E883E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1954E883E3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521BBF second address: 521BED instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1954C8B6ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1954C8B6F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521BED second address: 521BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521BF1 second address: 521C0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F4h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521C0F second address: 521C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521C21 second address: 521C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522E89 second address: 522EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1954E883D6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F1954E883E7h 0x00000011 jmp 00007F1954E883E5h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522EC3 second address: 522EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F1954C8B6ECh 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 526308 second address: 52630E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48ED96 second address: 48EDA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EDA0 second address: 48EDA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EDA4 second address: 48EDBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F1954C8B6EEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EDBB second address: 48EDE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F1954E883DCh 0x0000000e jbe 00007F1954E883D6h 0x00000014 jmp 00007F1954E883E5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EDE4 second address: 48EDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954C8B6EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490935 second address: 49093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528CA5 second address: 528CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 528CB0 second address: 528CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D080 second address: 52D0A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F1954C8B701h 0x0000000c jg 00007F1954C8B6E6h 0x00000012 jmp 00007F1954C8B6F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531ADC second address: 531AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531E8C second address: 531E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531E90 second address: 531E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53295B second address: 532981 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1954C8B6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1954C8B6F9h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532981 second address: 532996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883DAh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532996 second address: 5329BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6EAh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F1954C8B6F3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5329BB second address: 5329C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jc 00007F1954E883D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535EFB second address: 535EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535EFF second address: 535F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F1954E883DFh 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535F29 second address: 535F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1954C8B6E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F1954C8B6ECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536626 second address: 536640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F1954E883D6h 0x0000000f jbe 00007F1954E883D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F19E second address: 53F1A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F1A4 second address: 53F1A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F1A9 second address: 53F1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1954C8B6E6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F1BA second address: 53F1BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2B5 second address: 53D2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D2BA second address: 53D2D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F1954E883E5h 0x0000000a pop ebx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D41D second address: 53D427 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1954C8B6E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D427 second address: 53D431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D431 second address: 53D435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D435 second address: 53D439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D439 second address: 53D445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1954C8B6E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D6D1 second address: 53D6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D6D5 second address: 53D6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D6DB second address: 53D6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1954E883D6h 0x0000000a je 00007F1954E883D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E2AB second address: 53E2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F1954C8B6E6h 0x0000000e popad 0x0000000f push eax 0x00000010 js 00007F1954C8B6E6h 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E2C4 second address: 53E2C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E2C9 second address: 53E2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6EAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E2DC second address: 53E2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E892 second address: 53E896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E896 second address: 53E8BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F1954E883E7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E8BC second address: 53E8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1954C8B6F1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53EED0 second address: 53EEEA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F1954E883D6h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53EEEA second address: 53EEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53EEF0 second address: 53EEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53EEF4 second address: 53EEF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53EEF8 second address: 53EF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007F1954E883DAh 0x00000010 jp 00007F1954E883D6h 0x00000016 jmp 00007F1954E883E5h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5449C4 second address: 5449CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F1954C8B6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5449CE second address: 5449DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5449DB second address: 5449E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5449E1 second address: 544A0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883DAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1954E883E8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54883F second address: 54884A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54884A second address: 548850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548850 second address: 548860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548860 second address: 54886A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54886A second address: 54886E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547A90 second address: 547A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547A94 second address: 547ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954C8B6F9h 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F1954C8B6E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547ABD second address: 547AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547C1D second address: 547C3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 jmp 00007F1954C8B6EEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547C3C second address: 547C46 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1954E883E9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547C46 second address: 547C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6EDh 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547DDA second address: 547DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jc 00007F1954E883D6h 0x0000000c jp 00007F1954E883D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809F second address: 5480A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548491 second address: 548495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548495 second address: 5484B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1954C8B6F0h 0x0000000c jc 00007F1954C8B6E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E75E second address: 54E76A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E76A second address: 54E770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E8AB second address: 54E933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1954E883E2h 0x0000000b popad 0x0000000c jne 00007F1954E883DAh 0x00000012 jnc 00007F1954E883F0h 0x00000018 popad 0x00000019 pushad 0x0000001a jo 00007F1954E883F3h 0x00000020 jmp 00007F1954E883DAh 0x00000025 jmp 00007F1954E883E3h 0x0000002a jmp 00007F1954E883E6h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 jl 00007F1954E883D6h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E933 second address: 54E937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E937 second address: 54E93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EC23 second address: 54EC30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F1954C8B6E6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EC30 second address: 54EC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EF53 second address: 54EF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54EF57 second address: 54EF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F568 second address: 54F56E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F56E second address: 54F57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1954E883DBh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550528 second address: 550539 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1954C8B6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550539 second address: 55053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E2DC second address: 54E321 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954C8B6F4h 0x0000000b jg 00007F1954C8B704h 0x00000011 js 00007F1954C8B6E6h 0x00000017 jmp 00007F1954C8B6F8h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E321 second address: 54E32B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1954E883DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557D19 second address: 557D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6F0h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557D31 second address: 557D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557D37 second address: 557D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557D3B second address: 557D41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56468F second address: 564693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564693 second address: 564699 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564699 second address: 5646AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1954C8B6F0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5646AF second address: 5646CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E8h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564810 second address: 56481F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F1954C8B6E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 566CD4 second address: 566CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1954E883D6h 0x0000000a popad 0x0000000b jnc 00007F1954E883DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5668AA second address: 5668AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5668AE second address: 5668B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5668B4 second address: 5668C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5668C0 second address: 5668C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5669DA second address: 5669E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5669E4 second address: 5669F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1954E883D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5669F0 second address: 5669FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5669FA second address: 566A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1954E883D6h 0x0000000a jmp 00007F1954E883E4h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B483 second address: 56B4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jnl 00007F1954C8B6F2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1954C8B6F9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4B8 second address: 56B4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4BC second address: 56B4CA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1954C8B6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B4CA second address: 56B4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E8A9 second address: 56E8B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EA31 second address: 56EA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1954E883D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EA3B second address: 56EA62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F3h 0x00000007 jnc 00007F1954C8B6E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EA62 second address: 56EA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574726 second address: 57475E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6EFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F1954C8B6E8h 0x00000012 push eax 0x00000013 pop eax 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F1954C8B6F6h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57475E second address: 574764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574764 second address: 574768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C758 second address: 57C75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DDD8 second address: 57DDE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DDE2 second address: 57DDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DDE9 second address: 57DDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D1F7 second address: 48D1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D1FE second address: 48D211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954C8B6EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D211 second address: 48D231 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F1954E883E7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5847F3 second address: 5847F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5847F9 second address: 5847FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830C0 second address: 5830C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830C6 second address: 5830CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830CC second address: 5830D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830D0 second address: 5830D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58321F second address: 583225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583225 second address: 583232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1954E883D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58337A second address: 58338C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F1954C8B6E6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5834EA second address: 583514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F1954E883DCh 0x00000010 jne 00007F1954E883D6h 0x00000016 jmp 00007F1954E883DBh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583634 second address: 58364B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1954C8B6E6h 0x0000000a popad 0x0000000b jbe 00007F1954C8B6ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58364B second address: 583654 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583A4A second address: 583A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F1954C8B6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583A54 second address: 583A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583A5A second address: 583A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1954C8B6F8h 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5844ED second address: 584505 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F1954E883D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587695 second address: 58769B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58769B second address: 58769F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58769F second address: 5876A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D3E second address: 5A0D48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D48 second address: 5A0D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D4C second address: 5A0D6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954E883E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D6D second address: 5A0D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D71 second address: 5A0D77 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D77 second address: 5A0D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D7D second address: 5A0D98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1954E883E3h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0D98 second address: 5A0D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A09F0 second address: 5A0A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1954E883E2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0A07 second address: 5A0A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1954C8B6E6h 0x0000000a jmp 00007F1954C8B6F5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A0A26 second address: 5A0A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A546B second address: 5A5478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F1954C8B6E6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6BD2 second address: 5A6BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883E0h 0x00000009 jc 00007F1954E883D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6BF0 second address: 5A6C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1954C8B6F7h 0x0000000e jmp 00007F1954C8B6F4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6C24 second address: 5A6C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AABCC second address: 5AABEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1954C8B6F6h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AAD24 second address: 5AAD29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB165 second address: 5AB16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB16E second address: 5AB172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB172 second address: 5AB176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB527 second address: 5AB53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954E883E3h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACEBE second address: 5ACEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACEC2 second address: 5ACEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACEC6 second address: 5ACEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F1954C8B6EEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE6AE second address: 5AE6B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE6B4 second address: 5AE6DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F1954C8B6F0h 0x00000008 jmp 00007F1954C8B6EDh 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE6DC second address: 5AE6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1AF1 second address: 5B1B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1954C8B6F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1B0D second address: 5B1B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1B11 second address: 5B1B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1B19 second address: 5B1B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B584D second address: 5B5851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB6DC second address: 5BB6E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2BCE second address: 5B2BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1954C8B6E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F1954C8B6E6h 0x00000013 jc 00007F1954C8B6E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2BE7 second address: 5B2C34 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1954E883D6h 0x00000008 jg 00007F1954E883D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jg 00007F1954E883D6h 0x00000017 jmp 00007F1954E883E9h 0x0000001c pop edx 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 jmp 00007F1954E883E7h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B1699 second address: 5B16CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1954C8B6F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1954C8B6EEh 0x00000018 jnc 00007F1954C8B6E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B16CF second address: 5B16D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2A8B second address: 5B2AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1954C8B6E6h 0x00000009 jnp 00007F1954C8B6E6h 0x0000000f popad 0x00000010 jne 00007F1954C8B6ECh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D82DA second address: 4D82F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1954E883E5h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 32DDC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4CA0C4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 559408 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 6AA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A3577 rdtsc

0_2_004A3577

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B7DA6 sidt fword ptr [esp-02h]

0_2_004B7DA6

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7816

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050104E GetSystemInfo,VirtualAlloc,

0_2_0050104E

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A6CD4 Start: 004A6D48 End: 004A6CC8	0_2_004A6CD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A6C88 Start: 004A6D48 End: 004A6CC8	0_2_004A6C88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A6C9C Start: 004A6D48 End: 004A6CC8	0_2_004A6C9C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A3577 rdtsc

0_2_004A3577

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0032B9B4 LdrInitializeThunk,

0_2_0032B9B4

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F81E9 GetSystemTime,GetFileTime,

0_2_004F81E9

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561395
Start date and time:	2024-11-23 10:32:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.84, 20.223.35.26, 23.206.197.32, 23.206.197.50, 23.206.197.48, 23.206.197.43, 23.206.197.49, 23.206.197.34, 23.206.197.25, 23.206.197.35, 23.206.197.42
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, otelrules.azureedge.net, tse1.mm.bing.net, arc.msn.com, www-www.bing.com.trafficmanager.net, wns.notify.trafficmanager.net, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, ocsp.digicert.com, ocsp.edge.digicert.com, arc.trafficmanager.net, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
Report size getting too big, too many NtProtectVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	n5QCsKJ0CP.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	192.229.221.95
	https://b0.antidisesta1.com/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/#Xlhixacc.org	Get hash	malicious	Unknown	Browse	192.229.221.95
	30340299021065524077.js	Get hash	malicious	Strela Downloader	Browse	192.229.221.95
	BX9IkWcF80.exe	Get hash	malicious	ScreenConnect Tool	Browse	192.229.221.95

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5042968975831315
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'761'728 bytes
MD5:	a4ccc1e6f4894f4832ff349ee223714f
SHA1:	c1863ef0b3b70c0210e30bac674ccd04b0bc5857
SHA256:	f7a868b76e3f413f7cbeafd75c889febb45650ab6c963449f0c1d7ccc833c3b8
SHA512:	2d33b57f20309e10fa5d1ab1e9c5007de9a1f91518bb24caa8a94c56d356cc2f5f96d7319cdc2817c7a8b28e77629719fb5fd5a43a5ac418b4362e9277a16d66
SSDEEP:	24576:C1XYlL/FZd4ST4OX0Hvt0URsfBehvHBc1bGHA05tFwbwXKnl4Zg8sqhCFqzob+v9:Wi14S0UWuB+bjXm8s5uv/VvX56kVl
TLSH:	2BD54C92B40972CFD48E2374E62BCD87596D03B9571159D3A82CB57ABEA3CC132F9C24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ...............................*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1954DE660Ah
lar ebp, word ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	17ec0913a9849d6a2561c1f1a3a462ea	False	0.9301215277777778	data	7.771586120312369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
teifcfsu	0xa000	0x29e000	0x29c400	a30f520e34c13fbc6e683cda39cf78e5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cxpiqsak	0x2a8000	0x2000	0x400	34faaa8f5261e957058939ad5091f2a6	False	0.7998046875	data	6.223696439043342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2aa000	0x4000	0x2200	09b7561924790c3e72cabaf56b93d48c	False	0.06606158088235294	DOS executable (COM)	0.7433553511983096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 10:33:23.545825958 CET	1.1.1.1	192.168.2.6	0x9a97	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 10:33:23.545825958 CET	1.1.1.1	192.168.2.6	0x9a97	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:33:07
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x320000
File size:	2'761'728 bytes
MD5 hash:	A4CCC1E6F4894F4832FF349EE223714F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	3%
Signature Coverage:	4.1%
Total number of Nodes:	394
Total number of Limit Nodes:	21

Executed Functions

Function 0050104E Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11FA5FEC), ref: 0050105A
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 005010BB

Memory Dump Source

Source File: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: b1de86d9e2dbd61cbe4baef91bf1e5e9bb0319ab69348d9c2998c4bbc573ba16
Instruction ID: a37b6bdef2a8972ab55a8652713a7e99106b87eca0761dbb2bd0f0fe8ae16ae9
Opcode Fuzzy Hash: b1de86d9e2dbd61cbe4baef91bf1e5e9bb0319ab69348d9c2998c4bbc573ba16
Instruction Fuzzy Hash: 374125B1D01606AEEB2DDF51C845F9ABBACFB84740F0001A6B607CE8C2D67095D4CB95

Function 004A3577 Relevance: 1.6, APIs: 1, Instructions: 147
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004A3577

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0e35f455d8e3aa6ecd153f411039981eb01397b9c03237cea66fb9ad9808e351
Instruction ID: ea073b4f94380f9550bccf7c3fb63a0ac5f276ba39a9ced9eaad68ce224c2812
Opcode Fuzzy Hash: 0e35f455d8e3aa6ecd153f411039981eb01397b9c03237cea66fb9ad9808e351
Instruction Fuzzy Hash: 2741A2F250C300AFE7066F18EC856BEF7E9EF94320F16492DE2C182A00E77555449AA7

Function 004A6CD4 Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6D20

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 144ab11cc98e6fdd5b4317832cd9f6a7617590c238970bb5fc6e14998d679ee7
Instruction ID: 7445bcce513a4633a944ccbc391481b8c083ce79e0f953b9300edadcdcd6a2ab
Opcode Fuzzy Hash: 144ab11cc98e6fdd5b4317832cd9f6a7617590c238970bb5fc6e14998d679ee7
Instruction Fuzzy Hash: 1E1106F62082517DF700CA55AB60AFB63ADE6F3734B3A841FF881C6542D2594D4A623A

Function 004A6C88 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6D20

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4fd5b053749f2b13bb30543102d46d6e2a85a35fe89cb61a621c155563656026
Instruction ID: 66d53801f8ada4aebad36156b6a7912d8470c25e1c0bcc149bd61d44c63339d2
Opcode Fuzzy Hash: 4fd5b053749f2b13bb30543102d46d6e2a85a35fe89cb61a621c155563656026
Instruction Fuzzy Hash: 11112BF72082117DF300CA44AB60AFB63BDE6F7B30B3A841FF881C5542D2594D4A623A

Function 004A6C9C Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6D20

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3658d4a1f310665404eb4cc45c73a543edcc918abfae635a4b48846eca34efe1
Instruction ID: d3987333ef7ab532dd156603d3bb3b8233f82e1901fddffd28821c82282781b5
Opcode Fuzzy Hash: 3658d4a1f310665404eb4cc45c73a543edcc918abfae635a4b48846eca34efe1
Instruction Fuzzy Hash: CB01C8F72082116DF300CE45AB60AFB63BDE6E7770B3A842FF841C6542C2594D4A563A

Function 0032B9B4 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

XO, xrefs: 0032BCC6

Memory Dump Source

Source File: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID: XO
API String ID: 0-1882202049
Opcode ID: ed1d767bcab7ef421383307a5443b3ac17d520f605d8abbe074bb3e87d22b8d6
Instruction ID: c2708275b5324b1e806eb405a6faa3ae63b450b2f787d9663af138f9fbb3309f
Opcode Fuzzy Hash: ed1d767bcab7ef421383307a5443b3ac17d520f605d8abbe074bb3e87d22b8d6
Instruction Fuzzy Hash: D0618A72918AB6CFDB139F28A8103A9FB65EF41700F1A4466DC858FB96E7794C50C7C4

Function 004F576F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 004F5880
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 004F5894

Strings

.dll, xrefs: 004F57B7
.exe, xrefs: 004F57DB
1002, xrefs: 004F584A

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: d019dbae8b41db6a79fb922f7940116178f0170b71543463e11afc1c21480c5e
Instruction ID: 559cd5a63410d97190c8480a059b6099e70f5e1a46760edaaeaed80b3ea826be
Opcode Fuzzy Hash: d019dbae8b41db6a79fb922f7940116178f0170b71543463e11afc1c21480c5e
Instruction Fuzzy Hash: 24316C7540490EFFCF11AF50D904ABE7B75FF44340F10412AFB0596161CB3999A1DBAA

Function 004F82F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNELBASE(00B401D4,00004020,00000000,-11FA5FEC), ref: 004F83DD

Strings

@, xrefs: 004F831C

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 8659555a23b04a48664342b05b6af5cbc8adaf4cc8d32bf61580ee780c1ce0f4
Instruction ID: 059458244e84eaf31ce45a1278d117e9d980b54863722207b2cb4f5d086720f4
Opcode Fuzzy Hash: 8659555a23b04a48664342b05b6af5cbc8adaf4cc8d32bf61580ee780c1ce0f4
Instruction Fuzzy Hash: AA317175504709EFDF258F44C848BAEBBB0FF08704F00851EEA556B260CB79E6A5CB94

Function 004F5C75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,004F5C07,?,00000000,00000000), ref: 004F5D32
GetModuleHandleA.KERNEL32(00000000,?,?,?,004F5C07,?,00000000,00000000), ref: 004F5D40

Strings

.dll, xrefs: 004F5CA8

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: c0318f7bdf6507ab262d9028686172705eb3524c7a17e080420401ee475dc7a3
Instruction ID: e91460ea6ee294ba2dae024354896753ebb25758a2688a10c56988bcc94c758b
Opcode Fuzzy Hash: c0318f7bdf6507ab262d9028686172705eb3524c7a17e080420401ee475dc7a3
Instruction Fuzzy Hash: EB115E30102A4EEAEF309F20D50D77A7BB5FF10345F00811BE701491A0CB7D94E4DA8A

Function 004F85CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00B401D4,-11FA5FEC), ref: 004F8648
GetFileAttributesA.KERNEL32(00000000,-11FA5FEC), ref: 004F8656

Strings

@, xrefs: 004F85FB

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: a0925e01c5d7c86d07316bfbe32b2a0613ef9e32126afaa312db84d34b8fba91
Instruction ID: 4acf4f2316a86e8bd2d4db8f58ee320c0afaac4ad53cca824b04f65c4aeaaac2
Opcode Fuzzy Hash: a0925e01c5d7c86d07316bfbe32b2a0613ef9e32126afaa312db84d34b8fba91
Instruction Fuzzy Hash: 06014B70504149FAEF21AF54C909BBE7FB0AF45348F10406FE701AD1A1DFB99A91D64D

Function 004AFC96 Relevance: 4.6, APIs: 3, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 004AFCD3
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 004AFCFA
GetNativeSystemInfo.KERNELBASE(?), ref: 004AFD51

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c2cfa099889a2609786caf741cefcaaeb965d7eb8d2975d56ace81d932c2a5dc
Instruction ID: 6f1e84492b93701eb78cd22486f183a801036cceb831326735e93f03d86c9433
Opcode Fuzzy Hash: c2cfa099889a2609786caf741cefcaaeb965d7eb8d2975d56ace81d932c2a5dc
Instruction Fuzzy Hash: 89316CB260810E9FDF11DF60C848BDF3AB9EF55310F100026DE4286A50E77A8DA89F6D

Function 004F464F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 004F46B1

Strings

\\?\, xrefs: 004F470C

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: e3b79a1aa35b89bb1e83d32c470565eb2cc72a09bf3a751f1ceff7eb189606e9
Instruction ID: 4180d232f144239a9e004ae818fa0c5ec62680671d701c37982302f2677ee5c8
Opcode Fuzzy Hash: e3b79a1aa35b89bb1e83d32c470565eb2cc72a09bf3a751f1ceff7eb189606e9
Instruction Fuzzy Hash: 32313E3960060EBFDF21DF94CC09BAF77B5BF89344F041066FA00A51A0DB7A9662DB59

Function 004F5D5E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 004F5DC2

Strings

.dll, xrefs: 004F5D7F

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: a0aff10658118a50b7ed5ba99cf4695d5d4ab9b4d829f4db47858ca52f8f07e6
Instruction ID: b0e5bcf5ef9798db214ff14edb932ccf7f86242659214ae118984e8a54312bde
Opcode Fuzzy Hash: a0aff10658118a50b7ed5ba99cf4695d5d4ab9b4d829f4db47858ca52f8f07e6
Instruction Fuzzy Hash: E4F06D7510060DBFDF10EF54C949BBB3BA6BF48304F10801AFF148A152DB38C4A09A25

Function 004F87EB Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00B401D4,?,?,-11FA5FEC,?,?,?,-11FA5FEC,?), ref: 004F889D

Part of subcall function 004F879D: IsBadWritePtr.KERNEL32(?,00000004), ref: 004F87AB

CreateFileA.KERNEL32(?,?,?,-11FA5FEC,?,?,?,-11FA5FEC,?), ref: 004F88BD

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 31d0120efaa08abb71d66b625572863fc6cac0ea4b376b2c694e9b0e7f9e585d
Instruction ID: f2acb998b61bf6220192566825aa4f94a12a0095b804eeeaabacc0611f8ee2fc
Opcode Fuzzy Hash: 31d0120efaa08abb71d66b625572863fc6cac0ea4b376b2c694e9b0e7f9e585d
Instruction Fuzzy Hash: 46110B3510454EFADF22AF90CC09BAE3B71BF19384F44412EBB01590A0CB7A85A1EB55

Function 004F8157 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

GetCurrentProcess.KERNEL32(-11FA5FEC), ref: 004F8164
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 004F81CA

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: 1a5720357432eb57badb9dd0a0e18f6dbe355519c63d82ece89db2ffa584d215
Instruction ID: 1fcec44cb1ed936e1ba3fe748da53515ce134c5f306a8381235e553a6e29b4ab
Opcode Fuzzy Hash: 1a5720357432eb57badb9dd0a0e18f6dbe355519c63d82ece89db2ffa584d215
Instruction Fuzzy Hash: E0012C3210004EFA8F226FA5CD45CAF3B79BF98354B00421AFB0559011CF39D162DB66

Function 004F409C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004F40AB
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 5c19f2deca103100482cd085eaa0f4fd230abf971eaa0b73000b24d73b738ed0
Instruction ID: 8d39d6a9cd5afa6421dc762cdb634b87bd6dca335b56bcbad5c2fe86f1995f8e
Opcode Fuzzy Hash: 5c19f2deca103100482cd085eaa0f4fd230abf971eaa0b73000b24d73b738ed0
Instruction Fuzzy Hash: CCF0B47510460AEFCB218F60C95877F72B4FF84319F20407AD70185140DFB81A96DA96

Function 004A370E Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 004A370E

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b3dbd53376ab5a211be96031519e457a62aca27418fedde5e68a2eefcd4e28a3
Instruction ID: c82a8136b299091b3e4d77e3b813d9923c3ac12113f4107f2fa0d8e3bf015464
Opcode Fuzzy Hash: b3dbd53376ab5a211be96031519e457a62aca27418fedde5e68a2eefcd4e28a3
Instruction Fuzzy Hash: D3415FF650C600AFE705AE19DC41B7ABBE9EFC4360F16882DE6C5C3210D63588518B57

Function 00501A7A Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea8863d39bc55f4f9bdcf116b13bafdc59bdc4b64808bc2dbb600d042e828b4
Instruction ID: 5f25f559c3923e4be51c46df0c06e6c53400d346418b35d98b31927d0315e29c
Opcode Fuzzy Hash: 4ea8863d39bc55f4f9bdcf116b13bafdc59bdc4b64808bc2dbb600d042e828b4
Instruction Fuzzy Hash: E24179B1900A0AEFEB25CF24C944BAE7FA5FF44315F248495E502AB1C1D371AC90CF9A

Function 004F67D6 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 004F688B

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b91dde425f675792093e8df7e158052d99c239f4573de3319885d79c895b431a
Instruction ID: 4c2fcd919ff8d2822dc94228f60039a0ec0dcbb8c6db83878ff76aefc6dd3768
Opcode Fuzzy Hash: b91dde425f675792093e8df7e158052d99c239f4573de3319885d79c895b431a
Instruction Fuzzy Hash: F931B07190020DFADF20AF65DC45FAEB7B8FF08718F20816EF600AA191D7799A51CB18

Function 004A6C6A Relevance: 1.6, APIs: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6D20

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4add8fccf159be4ae6ae0c6db3ceffba09cce4774f9edb1c2dc7221bd4c22600
Instruction ID: 023d623ca257393b7d2e759908cc7f8a6431cb31538e5ce61480134ac7400c26
Opcode Fuzzy Hash: 4add8fccf159be4ae6ae0c6db3ceffba09cce4774f9edb1c2dc7221bd4c22600
Instruction Fuzzy Hash: CD1127F62082517DF301CA55AF60AFB6BBDD6E7770B3A841BF481C6502C2580D4AA23A

Function 004F5FF2 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 004F6074

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1ae823c769f37cc3c6436f61f06e9a6beb6b36027de03c1077f46cab4e0a7355
Instruction ID: d4e1c63056c844e2364c4b8585ba1463e2cbae2f2bd8d4011ba34a547a0f2f17
Opcode Fuzzy Hash: 1ae823c769f37cc3c6436f61f06e9a6beb6b36027de03c1077f46cab4e0a7355
Instruction Fuzzy Hash: 0E31F775540209BEEB30DF64DC46FAA77B8EF04728F20425AF710EA1D1C7B5A541CB58

Function 004A6DF2 Relevance: 1.6, APIs: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bd832d3e515f03f3f64f7789b184774ed5f3a403abae79ccd5692e5468466c27
Instruction ID: 8b04c4f437ba752d083d1700bdf8941375e1eb6d88cecf14f07372f62a677fa1
Opcode Fuzzy Hash: bd832d3e515f03f3f64f7789b184774ed5f3a403abae79ccd5692e5468466c27
Instruction Fuzzy Hash: C511A7FF2481517DB502CA55EF509FB776EE6E773073A842BF402C5506D69D0D092139

Function 004A6E1C Relevance: 1.6, APIs: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2e60eb68373eb1d19ee5d39b5d0912b3e6119d1c7fb40517e654ae16414c1bf
Instruction ID: d18566bdc7e78a23ea16b4ec2d73fd4a6a4bf7fd98af61254696b9d263eeaad4
Opcode Fuzzy Hash: e2e60eb68373eb1d19ee5d39b5d0912b3e6119d1c7fb40517e654ae16414c1bf
Instruction Fuzzy Hash: EA0188FB14C2517EF602CA55EE50AFB77ADE6D7730B35842BF402C2502D7A90D096636

Function 005017C7 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00501874

Memory Dump Source

Source File: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: c4fe10d3e3ca5d3986d9bf95be9bfdf0415d8b5857810f6635464affed623498
Instruction ID: c05cd086b609f928d3fd412af9ba299accf34fa280661a65b5650a9ada783840
Opcode Fuzzy Hash: c4fe10d3e3ca5d3986d9bf95be9bfdf0415d8b5857810f6635464affed623498
Instruction Fuzzy Hash: 1E119672E01A259FFB204A44CC48BEE7BACFF44750F64C095EC05960C1D7749E818BAA

Function 004A6CB3 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6D20

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ecadd5688fa92675b630bde9c279aeb30f0aa46e9ff10667571d060521da38bd
Instruction ID: 6b9326acbf9a6ba43cf713f3eed6275186c32d716c0ded92c64ac8aeab65bded
Opcode Fuzzy Hash: ecadd5688fa92675b630bde9c279aeb30f0aa46e9ff10667571d060521da38bd
Instruction Fuzzy Hash: 450147FA2082157CF301CE04AB60BFB63BDD2E6B70B3A881FF881C5542C2590D49523E

Function 004A6E44 Relevance: 1.6, APIs: 1, Instructions: 62fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 32c6fd52180b0bad8922e5853b9b9e78e07b504b3a4d3fbe9d8baecb5ea439d7
Instruction ID: 23833dde7cf301f66fa5f9c3cc1646ff2e2597b71db315487be121897f3e10c8
Opcode Fuzzy Hash: 32c6fd52180b0bad8922e5853b9b9e78e07b504b3a4d3fbe9d8baecb5ea439d7
Instruction Fuzzy Hash: FD0136FB14C2517DB501CA55AF50AFB779DE6D7730B35882BF402C6506D2A90D092639

Function 04960D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04960DCD

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 032d03de3c7cf3ee9cf5f21523131583780a7e4166c01c72993c7ae59ce4309a
Instruction ID: 4c1371fb1a98ac02492880a3b1a7e21e38afa75d13b024e784e13070575f988f
Opcode Fuzzy Hash: 032d03de3c7cf3ee9cf5f21523131583780a7e4166c01c72993c7ae59ce4309a
Instruction Fuzzy Hash: BB2104B6C013199FCB50CF99D884ADEFBF4FB88720F14862AD909AB245D774A540CBA4

Function 04960D43 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04960DCD

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5b9c2991b6011668feab17980c97bde07ca02fa62d3922abe8524f3604177fcd
Instruction ID: aa7f6f82856b66c87a24295a0895d1b575eef9599460dacac594d402ea611f78
Opcode Fuzzy Hash: 5b9c2991b6011668feab17980c97bde07ca02fa62d3922abe8524f3604177fcd
Instruction Fuzzy Hash: 6F2134B6C013098FCB40CFA9D480ADEFBF5BB88320F14822AD909AB245C774A541CBA4

Function 04961510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04961580

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 623444d71a3ee44f6a96525f7e199a2ace3b7bd8ffdd1797b1770149b2613576
Instruction ID: 73df644625b1bfb9ea479765075ab5d1d78f7e8b8944edc60133bb065a2de860
Opcode Fuzzy Hash: 623444d71a3ee44f6a96525f7e199a2ace3b7bd8ffdd1797b1770149b2613576
Instruction Fuzzy Hash: D51103B29003499FDB10CFAAC584BDEFBF4AB48320F10842AE519A3240D378A644CFA5

Function 04961509 Relevance: 1.6, APIs: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04961580

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 2215f83058765ebaeb7dd164fc2eb22ab250a96ed12b54abf630aa605ee80cef
Instruction ID: 23159f7fb61e5c207fb9708bf9a424eeb830aa12fac1e3c65918f132c227e032
Opcode Fuzzy Hash: 2215f83058765ebaeb7dd164fc2eb22ab250a96ed12b54abf630aa605ee80cef
Instruction Fuzzy Hash: 5E2103B6900349CFDB10CFAAC584BDEFBF4AB48320F14842AD559A7250D778A654CFA5

Function 004F9323 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11FA5FEC), ref: 004F93AA

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentFileSleepThreadView
String ID:
API String ID: 2270672837-0
Opcode ID: 16829569707f2360fc984357035402dafb50777c2824fd5356ba8d3e726a2ebf
Instruction ID: 475fa739d9369e7f27849a2c4e6317cf05878d038a1498fce8e129ae8af3227e
Opcode Fuzzy Hash: 16829569707f2360fc984357035402dafb50777c2824fd5356ba8d3e726a2ebf
Instruction Fuzzy Hash: 8411E83210454EFBCF126FA5CD09EAB3AA6BF4D344B014516FB1155065C73A8872EB6A

Function 004F910B Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 4a28735ff65659e84e7297bc8eeff0679555a6882c23ef907d873eeaafb77b38
Instruction ID: 88d290e01d998c5717b71bdb0880c8399eb49ff99e81d8cec5ec19725942bba7
Opcode Fuzzy Hash: 4a28735ff65659e84e7297bc8eeff0679555a6882c23ef907d873eeaafb77b38
Instruction Fuzzy Hash: FB113C3210010FEADF12AFA5CA0DFBF3A7AAF48344F144026FB1146165CB39CA66EB55

Function 004A6E64 Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e0ec247daa5152f1689ae89582e041db2da4d092f0ed5df236523f049ae9c74a
Instruction ID: 5f73f7e65f5939485ca791a98a102d9e2db7932d908ee51fbdf3af6419990a06
Opcode Fuzzy Hash: e0ec247daa5152f1689ae89582e041db2da4d092f0ed5df236523f049ae9c74a
Instruction Fuzzy Hash: 05F090FB14C2557DF201CE51AEA0AFBB7ADE6C2330B31882BF402C6502D2A90D0D2639

Function 04961301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04961367

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 7f7cc5e39d64127beb76a308f924499af8fc13af2a74eb14d5ab1ddbd2297c67
Instruction ID: 6a9df44dcb17514334f6cf3ff79d7e4320e785b079bcdf0a611f54b182fbb4e4
Opcode Fuzzy Hash: 7f7cc5e39d64127beb76a308f924499af8fc13af2a74eb14d5ab1ddbd2297c67
Instruction Fuzzy Hash: 851143B1800209CFDB10CF9AC545BEEFBF4EF48324F20842AD519A3240D778A544CBA5

Function 04961308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE(?), ref: 04961367

Memory Dump Source

Source File: 00000000.00000002.2331037755.0000000004960000.00000040.00000800.00020000.00000000.sdmp, Offset: 04960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4960000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 02296b36ce13df5ea3740394eb1033d9ac0ac0226732734094faf04fe43ae344
Instruction ID: 95012ce88d57e95dc693ec4d5a81f9a7721e7647e5d8576416eb3f2854177c90
Opcode Fuzzy Hash: 02296b36ce13df5ea3740394eb1033d9ac0ac0226732734094faf04fe43ae344
Instruction Fuzzy Hash: 081125B1800349CFDB10CF9AC545BDEFBF8AB48724F24842AD559A3640D778A544CBA5

Function 004F89EF Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11FA5FEC,?,?,004F671E,?,?,00000400,?,00000000,?,00000000), ref: 004F8A5B

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: 878a84821de4bceb33ff354172290cfbe2d523dc66b950dfb2b7743035a5d356
Instruction ID: a3b1e53b0ffd7bcd99a5c45dfb5e3b4e1737d85ae5e3b084166660deee8efc7f
Opcode Fuzzy Hash: 878a84821de4bceb33ff354172290cfbe2d523dc66b950dfb2b7743035a5d356
Instruction Fuzzy Hash: A0F0F63260010EEFCF125FA5D909DAF3B66EF88344F00411BFB115A121DB3AD5A2AB65

Function 004B10BB Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 004B431B

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 19360442d330afcf4d8f83734d75f6a43d63f3849588a99d132c0a35befc9e76
Instruction ID: aedf49fd72b0d21b3dc192b7c93e7152fdaa1c6edb7aff8447a7035581d06796
Opcode Fuzzy Hash: 19360442d330afcf4d8f83734d75f6a43d63f3849588a99d132c0a35befc9e76
Instruction Fuzzy Hash: 19F0547251C510DFD3015E19D98087AF7EAAF98350F260C2FE9C5C7250D6B81C519767

Function 004F59D2 Relevance: 1.5, APIs: 1, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(004F5188,004F5188), ref: 004F5A1D

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 37332bc96ef4b926ff6c5bc13e6f5134ab6838c4411ebb7322e4b87f2ebde282
Instruction ID: 73f02c0c5478d7e3d1bc7a412c49ca5a76e0ecb3d7aaba25d613c1f421091294
Opcode Fuzzy Hash: 37332bc96ef4b926ff6c5bc13e6f5134ab6838c4411ebb7322e4b87f2ebde282
Instruction Fuzzy Hash: 15E0923560080DFA8F123FB2ED0A87F3E65AF90358B008127BB1598021DF7DC5A3D629

Function 004A6B5B Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6B94

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 78198e188576101d2042d135f8b789000ae65d1ce5e518ee4bb222cbeed626b7
Instruction ID: 0cab62ae9cfccd2c1bbc72f9ebb62b69da332f9bdeedefed03470143592786f6
Opcode Fuzzy Hash: 78198e188576101d2042d135f8b789000ae65d1ce5e518ee4bb222cbeed626b7
Instruction Fuzzy Hash: 21D095A110F2B11ED2021AF1098477E77495BF7315F2580BA6081C71D3FD5450023764

Function 004A6B43 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 004A6B94

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 511e2cbfc46961a986d6e589209aa204294660e9aaea2e8488350c42a4a29980
Instruction ID: 49d3ef54c1646b2ed4df9f2b7e8be9d3437ff5fc83122d669e8d563eb437b11c
Opcode Fuzzy Hash: 511e2cbfc46961a986d6e589209aa204294660e9aaea2e8488350c42a4a29980
Instruction Fuzzy Hash: 94D095775492771DCA01DF044D90A7D31CC4773715F1E0C791840D30C1C59C7805457C

Function 004A6E90 Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e5bd853f31be1880a606a68c34d7be36ba5ccce1c075e7abbbc7a68e64436499
Instruction ID: cd5a0ea60144fe00d18a0c4e208c0976b237872024f2e55981f9ecffaee18e21
Opcode Fuzzy Hash: e5bd853f31be1880a606a68c34d7be36ba5ccce1c075e7abbbc7a68e64436499
Instruction Fuzzy Hash: ABE0C276148256AED704EF25CCE0A6FB7D9EB66341F45441F94538B681C6390C168B2D

Function 004A6EAA Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,004A6DEE,00000003,00000000,00000003), ref: 004A6EBE

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 900127ba9f5f0571a2559faa264658f14ccd9d71fc288d62e55c76d3f8ff274c
Instruction ID: fa4198dfc4a9b6cf900332547be8975aea5411146972bf238ba430bab43e408c
Opcode Fuzzy Hash: 900127ba9f5f0571a2559faa264658f14ccd9d71fc288d62e55c76d3f8ff274c
Instruction Fuzzy Hash: 5FD02EB2108326DFCBA0EF38CCD0B5E3392EBA2A20F058219D0508B5C1D2694C01A728

Function 004F426D Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 004F42D1

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 428353cd3c740191bc3a4466812cd069536bf8e0f77511902c4365e1f39c1d3a
Instruction ID: a65dd7983ac0dcd1f6d428878807f827e3c65bc3a63875486459c78650f71a19
Opcode Fuzzy Hash: 428353cd3c740191bc3a4466812cd069536bf8e0f77511902c4365e1f39c1d3a
Instruction Fuzzy Hash: EA01C439A0010EBBCF219FA5CC05DAFBB7AEF88380F0011A6B501A5161DB369661DA68

Function 005013F1 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,005013ED,?,?,005010F3,?,?,005010F3,?,?,005010F3), ref: 00501411

Memory Dump Source

Source File: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac13f3a7586780dc8a59f6504f0fbcbb9913ccf9289819b39f74fb51765b3ea7
Instruction ID: 470ae33b2985bfe6749812b6c9f3f3eaef6926fffc9cd12db9469766cc59f9a2
Opcode Fuzzy Hash: ac13f3a7586780dc8a59f6504f0fbcbb9913ccf9289819b39f74fb51765b3ea7
Instruction Fuzzy Hash: 0DF081B5900305EFDB258F14C905B5DBFB8FF84765F108064F44AAB6A1D3B198C0CB95

Function 004F6DF0 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

CloseHandle.KERNELBASE(004F67B3,-11FA5FEC,?,?,004F67B3,?), ref: 004F6E2E

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID:
API String ID: 4003616898-0
Opcode ID: 01703ff38b0c5c77bf4917aed074cbc06d53515f47ac8de90b0ada84dfa5fa21
Instruction ID: b4f473d275d3b0697ecf4eabff9aa655a5b453b71d7a25d26aeda1c8038fe3fa
Opcode Fuzzy Hash: 01703ff38b0c5c77bf4917aed074cbc06d53515f47ac8de90b0ada84dfa5fa21
Instruction Fuzzy Hash: 09E0127A60454EB5CE217F7DC80ED6F2E299FD5348B000127B70556055DE6891968629

Function 0032EC69 Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0032F969

Memory Dump Source

Source File: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3311077b29460bd726222e22c9a55b30d2e951cf3986366527b8116fb79e9478
Instruction ID: 1446b53975dbb3b537321e7f5491f4160b0d5805e8b08852162c19f30703ae16
Opcode Fuzzy Hash: 3311077b29460bd726222e22c9a55b30d2e951cf3986366527b8116fb79e9478
Instruction Fuzzy Hash: 1AF092F550CB109FD701AF2AD9853ADFAF4EF94720F06482EDAC487650E3700881CB86

Function 0032EB92 Relevance: 1.3, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0032ED60

Memory Dump Source

Source File: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f16b54c9b780d550941a073ab28694e63544bd2cf5407c946e4a85ae75944321
Instruction ID: a289c3b5b8ef090d0842b757afc2f343236ab03fbae6bc58ed10bfab6c8a8eec
Opcode Fuzzy Hash: f16b54c9b780d550941a073ab28694e63544bd2cf5407c946e4a85ae75944321
Instruction Fuzzy Hash: 75E039B14083189FD3022F3AE40A2EEB7A8EF15720F10851EF8954AA80D6B08C909F47

Function 004F5EB5 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,004F3F3B,?,?), ref: 004F5EBB

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c3f17c405cb21df37a6df50fcd48f3e821b13357b2c380101c2458b390dfb729
Instruction ID: ed4e513926da914f44fec31d0621a60d3550ec5d31e3de6b3722daaf99dff86e
Opcode Fuzzy Hash: c3f17c405cb21df37a6df50fcd48f3e821b13357b2c380101c2458b390dfb729
Instruction Fuzzy Hash: A9B0923900460DBBCF11BF52DC0684EBF79FF1A398B008125BA05454628BB6EA719BD4

Non-executed Functions

Function 004F81E9 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

GetSystemTime.KERNEL32(?,-11FA5FEC), ref: 004F821E
GetFileTime.KERNEL32(?,?,?,?,-11FA5FEC), ref: 004F8261

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: 471c4a46d4d214cf972c814bc049a9a053b7bfa977852d0915cf0089a7fde846
Instruction ID: b6e702f69b5c06fee50722611eb827446b93ed3a154ef0a93d232a1ce89a0ae0
Opcode Fuzzy Hash: 471c4a46d4d214cf972c814bc049a9a053b7bfa977852d0915cf0089a7fde846
Instruction Fuzzy Hash: BB011A3250444EEBCF225F6AD80CDAF3F79EFC5310B00412AFA1149461CF36E4A1EA26

Function 0032DDDC Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0032E0E1

Memory Dump Source

Source File: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: e84fb7ba6c499fda33d1873584c743e9dabca7fa22620a4551e281deb51d27ea
Instruction ID: f8daa0fa66d87c3c13beb355b1655e617e0def500f7147426226900127d2bd88
Opcode Fuzzy Hash: e84fb7ba6c499fda33d1873584c743e9dabca7fa22620a4551e281deb51d27ea
Instruction Fuzzy Hash: F291D07290822EDFCB02DF25E6062EF77A4FF55720F25852AE84287A41D3B25D11EF49

Function 004F90A7 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 004F90EE

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 7a26f4aebed9d4bb08812ad0a23fd12ce539fbb3afe98ab41e1ae7245100ed3f
Instruction ID: 306f2c916d97e27189b05e6e10859a2facde5b583cc0fdacd8c6ad39becde787
Opcode Fuzzy Hash: 7a26f4aebed9d4bb08812ad0a23fd12ce539fbb3afe98ab41e1ae7245100ed3f
Instruction Fuzzy Hash: FDF0D43660410EFFCF11CF94CA44A9C7BB2FF09344B108126AA0596150DB769AA1EF44

Function 004A4BD5 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

R, xrefs: 004A5AF8

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: cb347f05f33e1c74230c6690e200bbe9f1fc8a91d9b8fc78b6c871651b15e8b8
Instruction ID: f13f36f0dbe1fb20029255abd32c78888985476457cb0811e4e2a9254a43cfcf
Opcode Fuzzy Hash: cb347f05f33e1c74230c6690e200bbe9f1fc8a91d9b8fc78b6c871651b15e8b8
Instruction Fuzzy Hash: 735168B140864EDFDB01DF24CA85AAF7BB4EF19310F11092AED8582A11E7364D64DF5E

Function 004A8202 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

:~, xrefs: 004A8238

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID: :~
API String ID: 0-48370668
Opcode ID: 18b92fd2286eea7011e5cf14900b373a191471cf1a05e3b7eb666f0f6549654e
Instruction ID: ad1f56e0e059cdda1a2b321c1761a647295499e48bbda84eb530c9f12e93c6f9
Opcode Fuzzy Hash: 18b92fd2286eea7011e5cf14900b373a191471cf1a05e3b7eb666f0f6549654e
Instruction Fuzzy Hash: 0F3126B150C304AFE31ABF58D88266EFBE8FF18310F06492DE6C582651EB755850CB97

Function 004A435E Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9b422eb15b25156ea39f7baa39d8899f2e3ae0d1bbf2b945cdbc9bdfb7803a
Instruction ID: 3498318d1fd2b3609746f0983ade9795d3ac77b65b68934e2bb839f8559c75bc
Opcode Fuzzy Hash: 5e9b422eb15b25156ea39f7baa39d8899f2e3ae0d1bbf2b945cdbc9bdfb7803a
Instruction Fuzzy Hash: 32413AB250C610AFE702AF29D8416AEFBF5EF98320F06492DE6C4D3650D7359950CB97

Function 004B7DA6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7680ae1cb260e913c2ef1e2aae19ee925c696635c017fce3f2125a817e3716c
Instruction ID: 1c1ca142f5dad7842b89ba3d580685fecc55f6fe1e0e5f4507eecd325ff6659d
Opcode Fuzzy Hash: f7680ae1cb260e913c2ef1e2aae19ee925c696635c017fce3f2125a817e3716c
Instruction Fuzzy Hash: 42E04F760041059EC7009F54C84599FFBF8FF59310F208445F444C7322C2364C41DB39

Function 004F771F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 004F409C: GetCurrentThreadId.KERNEL32 ref: 004F40AB
Part of subcall function 004F409C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 004F40EE

Part of subcall function 004F879D: IsBadWritePtr.KERNEL32(?,00000004), ref: 004F87AB

wsprintfA.USER32 ref: 004F7765
LoadImageA.USER32(?,?,?,?,?,?), ref: 004F7829

Strings

%8x, xrefs: 004F77F3, 004F7826
%8x, xrefs: 004F7760, 004F7763

Memory Dump Source

Source File: 00000000.00000002.2325784771.00000000004F0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2324462057.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324581311.0000000000322000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324656924.0000000000326000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324736965.000000000032A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324803594.0000000000334000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324852174.0000000000335000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2324903944.0000000000336000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325342030.000000000048A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325426870.000000000048C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325523028.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325625619.00000000004B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325667126.00000000004B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325713305.00000000004DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325739146.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325758559.00000000004E5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325807974.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325828855.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325857838.000000000050F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325880356.0000000000512000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325903341.0000000000514000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325927335.0000000000517000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325953133.000000000051F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325971040.0000000000524000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2325997100.0000000000532000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326022019.0000000000533000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326044235.0000000000534000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326066704.0000000000537000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326088781.000000000053F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326109683.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326147491.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326173431.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326198150.000000000054A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326223519.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326250962.0000000000570000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326282743.0000000000571000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326324408.00000000005A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326347527.00000000005A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326369075.00000000005AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326395774.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326419200.00000000005B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326486060.00000000005C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2326514430.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: a36b30792a0ce448d64de1d201202e18129c85734a420f55e33c2bbb8997dc33
Instruction ID: 2cf4f4d1678af75c7b5cdcbe03d8df8ef8ba15d75424dc07ffa36760b24c2ba2
Opcode Fuzzy Hash: a36b30792a0ce448d64de1d201202e18129c85734a420f55e33c2bbb8997dc33
Instruction Fuzzy Hash: 0531267190010AFFCF11AF95DC09EAEBB79FF89300F108126B611A61A0D7759A61DB64

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 7696, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 7696, Parent PID: 4004COMMON

Execution Graph

Windows Analysis Report
file.exe

Function 0050104E Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 004A3577 Relevance: 1.6, APIs: 1, Instructions: 147
libraryCOMMON

Function 004F576F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 004F82F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Function 004F5C75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 004F85CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 004AFC96 Relevance: 4.6, APIs: 3, Instructions: 77
registryCOMMON

Function 004F464F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 004F5D5E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 004F87EB Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 004F8157 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 004F409C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 004A370E Relevance: 1.6, APIs: 1, Instructions: 125
libraryCOMMON

Function 00501A7A Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 004F67D6 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON