Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563925
MD5:	5c6793c38e495450cfaad82f97cdb333
SHA1:	82450ddb586697958df0b3d1a034592a52f0de02
SHA256:	68773dedc7b901d281897c8a79eeb4af1f56c307b8bf735485df770832c451ff
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6476 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5C6793C38E495450CFAAD82F97CDB333)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABE240 CryptVerifySignatureA,

0_2_00ABE240

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2352663718.0000000005130000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66B86	0_2_00A66B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66C03	0_2_00A66C03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6AE8D	0_2_00A6AE8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6AE0B	0_2_00A6AE0B

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00AB9235 appears 35 times

Source: file.exe, 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2488714939.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe	Binary or memory string: .vbpO
Source: file.exe	Binary or memory string: XC.vbP

Source: classification engine

Classification label: mal100.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: nRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeR

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2748416 > 1048576

Source: file.exe

Static PE information: Raw size of zkteabrp is bigger than: 0x100000 < 0x299000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.8e0000.0.unpack :EW;.rsrc:W;.idata :W;zkteabrp:EW;oljfpuhd:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2a01ac should be: 0x2ab639

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: zkteabrp
Source: file.exe	Static PE information: section name: oljfpuhd
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66D38 push 62F575FDh; mov dword ptr [esp], ecx	0_2_00A66D75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push esi; mov dword ptr [esp], ecx	0_2_00A66EA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push ecx; mov dword ptr [esp], esi	0_2_00A66ED9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push ecx; mov dword ptr [esp], esp	0_2_00A66EF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push ebp; mov dword ptr [esp], eax	0_2_00A66F16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push ebx; mov dword ptr [esp], edi	0_2_00A66F1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A66E84 push 0EE7D28Ah; mov dword ptr [esp], ebp	0_2_00A66F72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A73F6A push eax; mov dword ptr [esp], edx	0_2_00A774D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A73F6A push 07DF23FBh; mov dword ptr [esp], ecx	0_2_00A774E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A73F6A push esi; mov dword ptr [esp], ecx	0_2_00A7763B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ED082 push edi; mov dword ptr [esp], 2B539B94h	0_2_008ED39F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10AC push 73B4ED95h; mov dword ptr [esp], eax	0_2_008F1D81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10AC push eax; mov dword ptr [esp], 2C6927FCh	0_2_008F1D85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10AC push edx; mov dword ptr [esp], esp	0_2_008F1D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC3084 push 32B5F6A5h; mov dword ptr [esp], ecx	0_2_00AC30C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A690E5 push ebx; ret	0_2_00A6916F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7A0ED push ecx; mov dword ptr [esp], edx	0_2_00A7A100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10DD push 1E553576h; mov dword ptr [esp], edx	0_2_008F0AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10DD push 63FFC35Ah; mov dword ptr [esp], ebx	0_2_008F4B17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10DD push esi; mov dword ptr [esp], edi	0_2_008F4B1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A680FF push 09B58861h; mov dword ptr [esp], esi	0_2_00A684BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F20D3 push edi; mov dword ptr [esp], edx	0_2_008F20D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10F1 push 5AC9AB60h; mov dword ptr [esp], ebx	0_2_008F4502
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F10F1 push 530BC8D0h; mov dword ptr [esp], esp	0_2_008F450A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7102A push ebp; mov dword ptr [esp], 5E2D31D6h	0_2_00A7170E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6B032 push eax; mov dword ptr [esp], 1EBF09D5h	0_2_00A6B047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6B032 push ecx; mov dword ptr [esp], 545D0F01h	0_2_00A6B0CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6B032 push edi; mov dword ptr [esp], edx	0_2_00A6B167
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7A000 push ecx; mov dword ptr [esp], ebx	0_2_00A7A013
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6B01C push eax; mov dword ptr [esp], 1EBF09D5h	0_2_00A6B047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6B01C push ecx; mov dword ptr [esp], 545D0F01h	0_2_00A6B0CD

Source: file.exe

Static PE information: section name: entropy: 7.79004401594624

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F5A7 second address: A4F5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F5AF second address: A4F5D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FCCD0C7C4B6h 0x0000000a jmp 00007FCCD0C7C4C9h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F5D3 second address: A4F5F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCCD0C2CFE0h 0x0000000a jl 00007FCCD0C2CFD6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FCCD0C2CFD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66D4F second address: A66D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FCCD0C7C4B6h 0x0000000c jnl 00007FCCD0C7C4B6h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6741A second address: A67446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE7h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCCD0C2CFDFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67446 second address: A6744B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68DEB second address: A68DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68DEF second address: A68E00 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCD0C7C4B8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68E00 second address: A68E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FCCD0C2CFE6h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FCCD0C2CFDCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68ECD second address: A68EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCCD0C7C4BEh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68EE7 second address: A68EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68EEB second address: A68EFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68EFC second address: A68F06 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68F06 second address: A68F2B instructions: 0x00000000 rdtsc 0x00000002 je 00007FCCD0C7C4B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jmp 00007FCCD0C7C4C3h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68F2B second address: A68F7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jnl 00007FCCD0C2CFE8h 0x00000013 pop eax 0x00000014 mov dword ptr [ebp+122D2420h], edi 0x0000001a lea ebx, dword ptr [ebp+1244ECB3h] 0x00000020 add cl, FFFFFF8Eh 0x00000023 and ecx, 76A2EC16h 0x00000029 push eax 0x0000002a pushad 0x0000002b push ebx 0x0000002c je 00007FCCD0C2CFD6h 0x00000032 pop ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push edx 0x00000036 pop edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68FE7 second address: A690AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FCCD0C7C4B8h 0x0000000c popad 0x0000000d push eax 0x0000000e jnp 00007FCCD0C7C4D1h 0x00000014 pushad 0x00000015 jmp 00007FCCD0C7C4C7h 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d nop 0x0000001e je 00007FCCD0C7C4CBh 0x00000024 push 00000000h 0x00000026 je 00007FCCD0C7C4BCh 0x0000002c push 9BE60406h 0x00000031 jmp 00007FCCD0C7C4C7h 0x00000036 add dword ptr [esp], 6419FC7Ah 0x0000003d mov ecx, 6E1EE483h 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007FCCD0C7C4B8h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e push 00000000h 0x00000060 mov esi, dword ptr [ebp+122D38D4h] 0x00000066 push 00000003h 0x00000068 push edi 0x00000069 mov esi, 1A1675E3h 0x0000006e pop edi 0x0000006f call 00007FCCD0C7C4B9h 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 jns 00007FCCD0C7C4B6h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A690AF second address: A690EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCCD0C2CFE5h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FCCD0C2CFDEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A690EE second address: A690FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FCCD0C7C4BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A690FC second address: A69130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FCCD0C2CFE6h 0x0000000e mov eax, dword ptr [eax] 0x00000010 push esi 0x00000011 pushad 0x00000012 jmp 00007FCCD0C2CFDFh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69130 second address: A69143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a js 00007FCCD0C7C4BEh 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69143 second address: A691A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 mov dword ptr [ebp+122D1CBFh], edi 0x0000000c lea ebx, dword ptr [ebp+1244ECBCh] 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FCCD0C2CFD8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c pushad 0x0000002d mov edi, dword ptr [ebp+122D3BF8h] 0x00000033 mov edx, dword ptr [ebp+122D3A74h] 0x00000039 popad 0x0000003a mov esi, 6D5706EBh 0x0000003f call 00007FCCD0C2CFDEh 0x00000044 mov esi, ecx 0x00000046 pop ecx 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b jnc 00007FCCD0C2CFD6h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6925B second address: A6926D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCCD0C7C4BBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BE1F second address: A7BE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A898AF second address: A898C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87771 second address: A877AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FCCD0C2CFDCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCCD0C2CFDCh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCCD0C2CFE8h 0x00000017 jnp 00007FCCD0C2CFD6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A877AF second address: A877BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A877BB second address: A877BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A63 second address: A87A67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87BCF second address: A87BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87BD3 second address: A87BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87BD9 second address: A87BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87BE2 second address: A87BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D66 second address: A87D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D70 second address: A87D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FCCD0C7C4B6h 0x0000000c popad 0x0000000d jmp 00007FCCD0C7C4C3h 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D95 second address: A87D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D9E second address: A87DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87F73 second address: A87F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jg 00007FCCD0C2CFDAh 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCCD0C2CFE2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A880D1 second address: A880D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88248 second address: A8824C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886A2 second address: A886A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BE67 second address: A4BE6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BE6B second address: A4BE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8902D second address: A89031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89031 second address: A8903D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8903D second address: A8906E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE8h 0x00000007 jmp 00007FCCD0C2CFE5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8906E second address: A89090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jnc 00007FCCD0C7C4B6h 0x00000019 jnc 00007FCCD0C7C4B6h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89090 second address: A890AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFDEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FCCD0C2CFD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A890AA second address: A890AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E3F3 second address: A8E3F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E4C3 second address: A8E4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E4C7 second address: A8E517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FCCD0C2CFDAh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jne 00007FCCD0C2CFE8h 0x0000001b mov eax, dword ptr [eax] 0x0000001d jnl 00007FCCD0C2CFDEh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jc 00007FCCD0C2CFD6h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E517 second address: A8E51D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E51D second address: A8E522 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96002 second address: A96008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61C9E second address: A61CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCCD0C2CFF4h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95CF8 second address: A95D1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C8h 0x00000007 jc 00007FCCD0C7C4B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97F44 second address: A97F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97F48 second address: A97F80 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCCD0C7C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FCCD0C7C4C9h 0x00000012 js 00007FCCD0C7C4B8h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97F80 second address: A97FCA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FCCD0C2CFDCh 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FCCD0C2CFDEh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jmp 00007FCCD0C2CFDEh 0x00000021 pop eax 0x00000022 movzx esi, cx 0x00000025 call 00007FCCD0C2CFD9h 0x0000002a pushad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97FCA second address: A97FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jg 00007FCCD0C7C4C8h 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97FF0 second address: A97FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCCD0C2CFD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97FFB second address: A9804B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jmp 00007FCCD0C7C4BBh 0x00000013 push edx 0x00000014 jbe 00007FCCD0C7C4B6h 0x0000001a pop edx 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e js 00007FCCD0C7C4C3h 0x00000024 push esi 0x00000025 jmp 00007FCCD0C7C4BBh 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9804B second address: A98056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FCCD0C2CFD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98428 second address: A9842C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9842C second address: A98430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9860B second address: A9860F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98A76 second address: A98A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FCCD0C2CFD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98AE9 second address: A98B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ebx 0x00000006 push esi 0x00000007 jmp 00007FCCD0C7C4C7h 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e xchg eax, ebx 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FCCD0C7C4B8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov esi, dword ptr [ebp+122D27B4h] 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98DAB second address: A98DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98DAF second address: A98DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E95 second address: A98E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E99 second address: A98EA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98FB9 second address: A98FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99522 second address: A99528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99528 second address: A99550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FCCD0C2CFE1h 0x0000000e jmp 00007FCCD0C2CFDAh 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99550 second address: A99556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99556 second address: A99599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 jno 00007FCCD0C2CFDCh 0x0000000d mov dword ptr [ebp+122D2FE6h], edx 0x00000013 push 00000000h 0x00000015 mov di, 41C1h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FCCD0C2CFD8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push edi 0x00000039 push eax 0x0000003a pop eax 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99DC9 second address: A99DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E1A1 second address: A9E1E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FCCD0C2CFE4h 0x0000000f jno 00007FCCD0C2CFD6h 0x00000015 popad 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E1E3 second address: A9E20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FCCD0C7C4BFh 0x0000000d jmp 00007FCCD0C7C4BDh 0x00000012 js 00007FCCD0C7C4B6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E20E second address: A9E22A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FCCD0C2CFD6h 0x00000009 jmp 00007FCCD0C2CFDDh 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B7B6 second address: A9B7BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E22A second address: A9E230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CED3 second address: A9CED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B7BC second address: A9B7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CED7 second address: A9CEDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57CBB second address: A57CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CEDD second address: A9CEE7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCCD0C7C4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57CBF second address: A57CD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F25C second address: A9F266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FCC0 second address: A9FCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F07A second address: A9F08E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C7C4C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FCC8 second address: A9FD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FCCD0C2CFD8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 je 00007FCCD0C2CFE4h 0x00000029 pushad 0x0000002a mov esi, dword ptr [ebp+122D39B8h] 0x00000030 sub dword ptr [ebp+1247858Eh], esi 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FCCD0C2CFD8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 mov dword ptr [ebp+122D1F7Eh], eax 0x00000059 push 00000000h 0x0000005b mov edi, dword ptr [ebp+122D3910h] 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 jnp 00007FCCD0C2CFDCh 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FD43 second address: A9FD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FD47 second address: A9FD4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0399 second address: AA039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2402 second address: AA245F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCCD0C2CFDCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FCCD0C2CFD8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+122D1D85h] 0x0000002f mov ebx, 1B361469h 0x00000034 push 00000000h 0x00000036 movzx edi, bx 0x00000039 push 00000000h 0x0000003b jmp 00007FCCD0C2CFDDh 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 js 00007FCCD0C2CFD6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA245F second address: AA2469 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCCD0C7C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA36F7 second address: AA3702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46B4 second address: AA46BA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3702 second address: AA3706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA555C second address: AA55CB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FCCD0C7C4C8h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, ecx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FCCD0C7C4B8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+124785FFh], edx 0x00000030 push 00000000h 0x00000032 call 00007FCCD0C7C4C3h 0x00000037 pop ebx 0x00000038 pushad 0x00000039 mov ecx, dword ptr [ebp+124528F6h] 0x0000003f mov ecx, ebx 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push eax 0x00000047 pop eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA762D second address: AA7641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFDFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7641 second address: AA7663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FCCD0C7C4B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB8C7 second address: AAB8DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB8DF second address: AAB8F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCD0C7C4BFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB8F3 second address: AAB960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FCCD0C2CFD8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007FCCD0C2CFE3h 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D2D21h] 0x00000031 push 00000000h 0x00000033 mov ebx, dword ptr [ebp+122D2465h] 0x00000039 pushad 0x0000003a pushad 0x0000003b mov eax, dword ptr [ebp+122D3BC0h] 0x00000041 push ecx 0x00000042 pop ebx 0x00000043 popad 0x00000044 or dword ptr [ebp+12450794h], ebx 0x0000004a popad 0x0000004b xchg eax, esi 0x0000004c jbe 00007FCCD0C2CFE8h 0x00000052 push eax 0x00000053 push edx 0x00000054 jo 00007FCCD0C2CFD6h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB960 second address: AAB964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB964 second address: AAB970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB970 second address: AAB975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB975 second address: AAB97F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FCCD0C2CFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0094 second address: AB0098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0098 second address: AB009E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB009E second address: AB00C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCD0C7C4BCh 0x00000008 jne 00007FCCD0C7C4B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCCD0C7C4BEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB10CC second address: AB10D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FCCD0C2CFD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F95 second address: AB1F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F99 second address: AB2020 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FCCD0C2CFDCh 0x0000000e jp 00007FCCD0C2CFECh 0x00000014 popad 0x00000015 nop 0x00000016 jne 00007FCCD0C2CFD9h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FCCD0C2CFD8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 sub ebx, dword ptr [ebp+122D1C95h] 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push edi 0x00000043 call 00007FCCD0C2CFD8h 0x00000048 pop edi 0x00000049 mov dword ptr [esp+04h], edi 0x0000004d add dword ptr [esp+04h], 00000015h 0x00000055 inc edi 0x00000056 push edi 0x00000057 ret 0x00000058 pop edi 0x00000059 ret 0x0000005a xchg eax, esi 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2020 second address: AB202E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCD0C7C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2FDF second address: AB3052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sub dword ptr [ebp+122D1DA9h], ebx 0x00000013 call 00007FCCD0C2CFE5h 0x00000018 mov dword ptr [ebp+122D31ECh], edi 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 mov ebx, dword ptr [ebp+122D3B00h] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FCCD0C2CFD8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 push eax 0x00000044 pushad 0x00000045 pushad 0x00000046 jmp 00007FCCD0C2CFDCh 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e push edi 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAA7B second address: AAAB0D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCCD0C7C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov bx, di 0x0000000e push dword ptr fs:[00000000h] 0x00000015 add edi, dword ptr [ebp+122D3B44h] 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007FCCD0C7C4B8h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov eax, dword ptr [ebp+122D0505h] 0x00000042 mov dword ptr [ebp+122D1DC9h], eax 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push edx 0x0000004d call 00007FCCD0C7C4B8h 0x00000052 pop edx 0x00000053 mov dword ptr [esp+04h], edx 0x00000057 add dword ptr [esp+04h], 0000001Dh 0x0000005f inc edx 0x00000060 push edx 0x00000061 ret 0x00000062 pop edx 0x00000063 ret 0x00000064 clc 0x00000065 mov dword ptr [ebp+122D3285h], ebx 0x0000006b nop 0x0000006c push ebx 0x0000006d jmp 00007FCCD0C7C4BFh 0x00000072 pop ebx 0x00000073 push eax 0x00000074 push ebx 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 popad 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABAE1 second address: AABB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 jmp 00007FCCD0C2CFE1h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 call 00007FCCD0C2CFE1h 0x00000017 or ebx, dword ptr [ebp+122D3BDCh] 0x0000001d pop edi 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 sub dword ptr [ebp+122D37EAh], edi 0x0000002b mov eax, dword ptr [ebp+122D12F5h] 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FCCD0C2CFD8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov dword ptr [ebp+12478346h], ecx 0x00000051 push FFFFFFFFh 0x00000053 add bh, 00000071h 0x00000056 nop 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a push edi 0x0000005b pop edi 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABB58 second address: AABB61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABB61 second address: AABB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADB17 second address: AADBAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FCCD0C7C4BCh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FCCD0C7C4B8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b or ebx, dword ptr [ebp+122D2EBAh] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov bx, CA74h 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 jnp 00007FCCD0C7C4B6h 0x00000049 mov eax, dword ptr [ebp+122D01B1h] 0x0000004f cmc 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push edi 0x00000055 call 00007FCCD0C7C4B8h 0x0000005a pop edi 0x0000005b mov dword ptr [esp+04h], edi 0x0000005f add dword ptr [esp+04h], 00000019h 0x00000067 inc edi 0x00000068 push edi 0x00000069 ret 0x0000006a pop edi 0x0000006b ret 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jl 00007FCCD0C7C4B8h 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0270 second address: AB0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0275 second address: AB02F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCD0C7C4BAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 je 00007FCCD0C7C4C4h 0x00000016 pushad 0x00000017 sub dword ptr [ebp+1246F27Bh], ebx 0x0000001d xor edx, 0A58D985h 0x00000023 popad 0x00000024 push dword ptr fs:[00000000h] 0x0000002b pushad 0x0000002c mov edx, esi 0x0000002e mov si, cx 0x00000031 popad 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 stc 0x0000003a mov eax, dword ptr [ebp+122D1419h] 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007FCCD0C7C4B8h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 00000017h 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a mov dword ptr [ebp+122D2C43h], eax 0x00000060 push ecx 0x00000061 mov di, ax 0x00000064 pop edi 0x00000065 push FFFFFFFFh 0x00000067 jp 00007FCCD0C7C4BAh 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push edi 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB02F6 second address: AB02FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB02FB second address: AB0309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C7C4BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0309 second address: AB030D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB124B second address: AB1256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCCD0C7C4B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1256 second address: AB12F1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCCD0C2CFD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr [ebp+12452911h], ecx 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FCCD0C2CFD8h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b pushad 0x0000003c pushad 0x0000003d sub dword ptr [ebp+12450794h], esi 0x00000043 jc 00007FCCD0C2CFD6h 0x00000049 popad 0x0000004a mov ebx, dword ptr [ebp+122D3A48h] 0x00000050 popad 0x00000051 mov eax, dword ptr [ebp+122D1331h] 0x00000057 or dword ptr [ebp+122D1D08h], eax 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push ebp 0x00000062 call 00007FCCD0C2CFD8h 0x00000067 pop ebp 0x00000068 mov dword ptr [esp+04h], ebp 0x0000006c add dword ptr [esp+04h], 0000001Ah 0x00000074 inc ebp 0x00000075 push ebp 0x00000076 ret 0x00000077 pop ebp 0x00000078 ret 0x00000079 and bl, FFFFFFB4h 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f push edx 0x00000080 jmp 00007FCCD0C2CFDDh 0x00000085 pop edx 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2218 second address: AB221E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB221E second address: AB2222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2222 second address: AB2231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2231 second address: AB2237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2237 second address: AB223B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3215 second address: AB3226 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3671 second address: AC3675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2DF2 second address: AC2E08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2E08 second address: AC2E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FCCD0C7C4C4h 0x0000000c jmp 00007FCCD0C7C4BEh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2E28 second address: AC2E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC312F second address: AC3135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3135 second address: AC3139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB426 second address: ACB42C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACB42C second address: ACB432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E7CE second address: A5E7DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD16CB second address: AD16D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1C4F second address: AD1C6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007FCCD0C7C4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 je 00007FCCD0C7C4B6h 0x00000016 pushad 0x00000017 popad 0x00000018 jnl 00007FCCD0C7C4B6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F15 second address: AD1F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFDAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F24 second address: AD1F3C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jmp 00007FCCD0C7C4BBh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F3C second address: AD1F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F41 second address: AD1F4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FCCD0C7C4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD863E second address: AD8672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FCCD0C2CFE5h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 js 00007FCCD0C2CFD6h 0x0000001a pop edi 0x0000001b pushad 0x0000001c jl 00007FCCD0C2CFD6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD8672 second address: AD867B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD946 second address: ADD94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD94A second address: ADD964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD964 second address: ADD971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD971 second address: ADD977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A967FE second address: A96816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C2CFE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CE7 second address: A96CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CEC second address: A96CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CF2 second address: A96CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96F2D second address: A96F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96F32 second address: A96F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCD0C7C4BDh 0x00000008 je 00007FCCD0C7C4B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9711D second address: A97137 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b mov dword ptr [ebp+122D23E2h], ebx 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97210 second address: A97214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97214 second address: A9721D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9737F second address: A97390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4BCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97B4D second address: A97BB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FCCD0C2CFDCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 adc dx, 1A8Dh 0x00000015 je 00007FCCD0C2CFE2h 0x0000001b jmp 00007FCCD0C2CFDCh 0x00000020 lea eax, dword ptr [ebp+1247C5ABh] 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FCCD0C2CFD8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov edx, dword ptr [ebp+122D307Ch] 0x00000046 nop 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a je 00007FCCD0C2CFD6h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97BB4 second address: A97BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FCCD0C7C4B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCB8D second address: ADCB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCE50 second address: ADCE5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCE5A second address: ADCE60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD243 second address: ADD24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD24D second address: ADD253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1BC7 second address: AE1BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1BD0 second address: AE1BE2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FCCD0C2CFDCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D57 second address: AE1D73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C5h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D73 second address: AE1D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE212D second address: AE2131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2131 second address: AE2147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCD0C2CFDCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2147 second address: AE214D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE214D second address: AE2155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2155 second address: AE2159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE258F second address: AE2593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2593 second address: AE25AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE29A2 second address: AE29B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C2CFDDh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE29B5 second address: AE29B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE29B9 second address: AE29BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2EA4 second address: AE2EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCCD0C7C4BBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2EB4 second address: AE2EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2EBA second address: AE2EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2EC3 second address: AE2ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCCD0C2CFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE18A6 second address: AE18C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FCCD0C7C4B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE18C7 second address: AE1901 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCCD0C2CFD6h 0x00000008 jmp 00007FCCD0C2CFE9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCCD0C2CFE4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1901 second address: AE1907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE76CF second address: AE76D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE809C second address: AE80A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE80A0 second address: AE80CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCCD0C2CFDBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE80CA second address: AE80CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF010C second address: AF0117 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007FCCD0C2CFD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B8D second address: A52B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B97 second address: A52BB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FCCD0C2CFD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jng 00007FCCD0C2CFD6h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5AB5 second address: AF5ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5ABB second address: AF5ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCD0C2CFE5h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5ADD second address: AF5AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5AE1 second address: AF5AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5AE7 second address: AF5AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5F67 second address: AF5F6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5F6B second address: AF5F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4C4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jc 00007FCCD0C7C4B6h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5F8D second address: AF5F92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5F92 second address: AF5FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCCD0C7C4B6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FCCD0C7C4B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF60EB second address: AF60F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF60F1 second address: AF6101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C7C4BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9764A second address: A9765A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFDBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9765A second address: A97664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97664 second address: A976A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FCCD0C2CFD8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+1247C5A6h] 0x00000029 movzx ecx, di 0x0000002c add eax, ebx 0x0000002e mov edi, eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jg 00007FCCD0C2CFD6h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A976A3 second address: A976DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FCCD0C7C4B8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov di, cx 0x00000027 push 00000004h 0x00000029 pushad 0x0000002a push edi 0x0000002b cmc 0x0000002c pop eax 0x0000002d mov ebx, edx 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push edx 0x00000035 pop edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF63B3 second address: AF63BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF63BD second address: AF63C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF63C3 second address: AF63CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF63CE second address: AF63FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FCCD0C7C4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007FCCD0C7C4C3h 0x00000014 pop edi 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF703E second address: AF7046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7046 second address: AF707B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FCCD0C7C4C1h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCCD0C7C4C3h 0x00000015 js 00007FCCD0C7C4B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8A0F second address: AF8A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8A17 second address: AF8A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8A1D second address: AF8A23 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBA50 second address: AFBA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB24F second address: AFB25A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB25A second address: AFB262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFB262 second address: AFB276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jbe 00007FCCD0C2CFD6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF80B second address: AFF80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEB55 second address: AFEB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jc 00007FCCD0C2CFD6h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCCD0C2CFE2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEB76 second address: AFEB80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEB80 second address: AFEB84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B075A7 second address: B075AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05969 second address: B0596D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06486 second address: B064C9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCCD0C7C4CDh 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FCCD0C7C4BEh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCCD0C7C4BBh 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B064C9 second address: B064DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFDEh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06ADA second address: B06ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06ADE second address: B06AF5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007FCCD0C2CFD6h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06FEC second address: B06FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F6F2 second address: B0F6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EAC5 second address: B0EACA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EACA second address: B0EAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCCD0C2CFE7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EAE8 second address: B0EAFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C7C4C3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EEDC second address: B0EF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFE0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCCD0C2CFDBh 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FCCD0C2CFD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EF06 second address: B0EF0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EF0A second address: B0EF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0EF10 second address: B0EF1A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCCD0C7C4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F18F second address: B0F1A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C2CFDEh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F2A1 second address: B0F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F403 second address: B0F432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCCD0C2CFDFh 0x00000010 je 00007FCCD0C2CFDCh 0x00000016 jc 00007FCCD0C2CFD6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F432 second address: B0F440 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FCCD0C7C4B6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F440 second address: B0F444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16E73 second address: B16EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4BDh 0x00000009 jmp 00007FCCD0C7C4C4h 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007FCCD0C7C4C6h 0x00000015 jno 00007FCCD0C7C4B6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15777 second address: B1577D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15909 second address: B15913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCCD0C7C4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15913 second address: B15919 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16430 second address: B16487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007FCCD0C7C4B6h 0x00000011 popad 0x00000012 push ecx 0x00000013 jmp 00007FCCD0C7C4C4h 0x00000018 pop ecx 0x00000019 popad 0x0000001a pushad 0x0000001b jg 00007FCCD0C7C4C6h 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007FCCD0C7C4BEh 0x00000028 jbe 00007FCCD0C7C4BEh 0x0000002e pushad 0x0000002f jns 00007FCCD0C7C4B6h 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F25D second address: B1F277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCCD0C2CFE2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F277 second address: B1F2A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCCD0C7C4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FCCD0C7C4D0h 0x00000010 jmp 00007FCCD0C7C4C8h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AE3D second address: B2AE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCCD0C2CFDCh 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FCCD0C2CFDDh 0x00000014 pop ecx 0x00000015 jmp 00007FCCD0C2CFDBh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DD92 second address: B2DD9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DAA3 second address: B2DAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DAAB second address: B2DABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jns 00007FCCD0C7C4B6h 0x0000000c pop edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B356DD second address: B356E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3433A second address: B34341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34341 second address: B34349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34349 second address: B3434D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B344C4 second address: B344F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFE7h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jmp 00007FCCD0C2CFDEh 0x00000011 popad 0x00000012 push esi 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E374 second address: B3E384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jl 00007FCCD0C7C4B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4417B second address: B4418B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4418B second address: B44191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44191 second address: B44196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44629 second address: B4465B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4C9h 0x00000009 popad 0x0000000a pop esi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FCCD0C7C4B6h 0x00000014 jmp 00007FCCD0C7C4BAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4465B second address: B4465F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4465F second address: B44669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44669 second address: B44673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCCD0C2CFD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44931 second address: B4494A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FCCD0C7C4C0h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4494A second address: B4494E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4494E second address: B44952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44AB1 second address: B44AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F01 second address: B46F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F07 second address: B46F13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F13 second address: B46F19 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F19 second address: B46F30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCCD0C2CFE1h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F30 second address: B46F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61AE4 second address: B61AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61AE8 second address: B61B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCCD0C7C4BEh 0x0000000f jmp 00007FCCD0C7C4C8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61B18 second address: B61B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCCD0C2CFE8h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B649CB second address: B649D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B649D1 second address: B649DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B649DA second address: B649EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C7C4BDh 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B649EF second address: B64A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCCD0C2CFE7h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FCCD0C2CFD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64A13 second address: B64A50 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007FCCD0C7C4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007FCCD0C7C4B6h 0x00000017 jmp 00007FCCD0C7C4C3h 0x0000001c popad 0x0000001d pushad 0x0000001e jo 00007FCCD0C7C4B6h 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 popad 0x00000027 jp 00007FCCD0C7C4BCh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6457F second address: B64584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64584 second address: B64590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FCCD0C7C4B6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64590 second address: B645B4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCCD0C2CFD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FCCD0C2CFE5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6BECB second address: B6BED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C83F second address: B6C856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCCD0C2CFDFh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C856 second address: B6C8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FCCD0C7C4CFh 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007FCCD0C7C4BCh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCCD0C7C4C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C8A0 second address: B6C8A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6FF2F second address: B6FF33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6FF33 second address: B6FF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E54 second address: B70E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E59 second address: B70E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E5F second address: B70E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E63 second address: B70E6D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCCD0C2CFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E6D second address: B70E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E77 second address: B70E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A989 second address: A9A98D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AB5D second address: A9AB67 instructions: 0x00000000 rdtsc 0x00000002 je 00007FCCD0C2CFD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AB67 second address: A9AB83 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCCD0C7C4B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jns 00007FCCD0C7C4B6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A8E352 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8EDC91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B21C58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8F0A51 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7530000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A69199 rdtsc

0_2_00A69199

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A7AF36 sidt fword ptr [esp-02h]

0_2_00A7AF36

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6968

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A69199 rdtsc

0_2_00A69199

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008EB7DE LdrInitializeThunk,

0_2_008EB7DE

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ABD382 GetSystemTime,GetFileTime,

0_2_00ABD382

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	41 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	271 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	1 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563925
Start date and time:	2024-11-27 16:30:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.482804309089373
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'748'416 bytes
MD5:	5c6793c38e495450cfaad82f97cdb333
SHA1:	82450ddb586697958df0b3d1a034592a52f0de02
SHA256:	68773dedc7b901d281897c8a79eeb4af1f56c307b8bf735485df770832c451ff
SHA512:	010806a5a53a8d4817715fa73be284f8f38666429b544cd0cbaf4a7b76ab4a0884279d0ef8f9742b29b40c42e4ab8edfc3e3c99198be11dd55e35c71581854f4
SSDEEP:	49152:vtHJIOxCG8EFfZ27WYCDK5AxhZ5+z9q65a:v5JIOYGrZ27KD2zba
TLSH:	E5D53B527505B2CFE48E27789427CD82696E42F9872048DBBD6C74BE7DA3CC121F6CA4
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`.. ...`....@.. ...............................*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6a6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCCD0DC19AAh
bswap esi
sub dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FCCD0DC39A5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	57f895f399dc34c522cfda6d88c6d215	False	0.9331597222222222	data	7.79004401594624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zkteabrp	0xa000	0x29a000	0x299000	597cb51235c15c4a0c6d89162f002c14	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oljfpuhd	0x2a4000	0x2000	0x400	9b881fc8460b7e2e36ac76cd37d37888	False	0.78515625	data	6.118431224978517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2a6000	0x4000	0x2200	46061ccdcecd2b8685eae7089d3da61d	False	0.06169577205882353	DOS executable (COM)	0.7484941170073209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	10:31:38
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8e0000
File size:	2'748'416 bytes
MD5 hash:	5C6793C38E495450CFAAD82F97CDB333
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	2.1%
Total number of Nodes:	285
Total number of Limit Nodes:	12

Executed Functions

Function 00A69199 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 00A691C2

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2da5b91ef5723f947264e4cec83d624f1a2cfe41daf773b3d61b5690356ae385
Instruction ID: 1e282c4df123ec4d79697ce0209e67dcb9e14690d997cbed27001665a84a12c6
Opcode Fuzzy Hash: 2da5b91ef5723f947264e4cec83d624f1a2cfe41daf773b3d61b5690356ae385
Instruction Fuzzy Hash: 80D05EF34882127DF14263A51D1DABB663DDB93330B31C96AF844E6182F5F40D450134

Function 008EB7DE Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 008EB94E

Memory Dump Source

Source File: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 5d0991801efce1edc8d8c14c88b74afa666e9686c8ad6ca84df1d82c6b19ae51
Instruction ID: b673fe5a2adb55e06908e0340af31d7cc176b48b19fc24f78f057deaf1d2b542
Opcode Fuzzy Hash: 5d0991801efce1edc8d8c14c88b74afa666e9686c8ad6ca84df1d82c6b19ae51
Instruction Fuzzy Hash: F2E086711044C59ACB17BF25880175B3B09FF42700F900125FA41DAA86DB2D0C118756

Function 00ABA908 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00ABAA19
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00ABAA2D

Strings

.exe, xrefs: 00ABA974
.dll, xrefs: 00ABA950
1002, xrefs: 00ABA9E3

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 6075d357e13e69aaa6f95b7db5a40a04632aec620b50dc9033eb10fe3ea37556
Instruction ID: 8afdccc4b100a4f051b4a190f7794fe8b1034cf1cccd732788da02c216959210
Opcode Fuzzy Hash: 6075d357e13e69aaa6f95b7db5a40a04632aec620b50dc9033eb10fe3ea37556
Instruction Fuzzy Hash: A2318031904105FFCF25AF50DA05AEE7BBDFF28350F11411AF90696163C73199A0EBA2

Function 00ABAE0E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00ABADA0,?,00000000,00000000), ref: 00ABAECB
GetModuleHandleA.KERNEL32(00000000,?,?,?,00ABADA0,?,00000000,00000000), ref: 00ABAED9

Strings

.dll, xrefs: 00ABAE41

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: e579c4f8fb0eb354a3ea857f6cd5140dd6f400524b22355a8fe2ae3a655fbeed
Instruction ID: c8a9efa40d59ed836d8de66eb35d0d8966a959a6ce4bf6b311f94dfb05bb58f4
Opcode Fuzzy Hash: e579c4f8fb0eb354a3ea857f6cd5140dd6f400524b22355a8fe2ae3a655fbeed
Instruction Fuzzy Hash: 6D11273224462AFADF309F14C94DBEE76BCBF24345F40422AA505854A2C7B6D9E4DA93

Function 00ABD768 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(015FE482,-119E5FEC), ref: 00ABD7E1
GetFileAttributesA.KERNEL32(00000000,-119E5FEC), ref: 00ABD7EF

Strings

@, xrefs: 00ABD794

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 14b5fdd5b5320f254d5a841c74739aa18e3839295b191e0d0c7a0e5afc33ca12
Instruction ID: f365de8ef0af0646f88eaf176662d216726596c5db1531dfc2079d8262d4936d
Opcode Fuzzy Hash: 14b5fdd5b5320f254d5a841c74739aa18e3839295b191e0d0c7a0e5afc33ca12
Instruction Fuzzy Hash: CC0169B0A04205FAEF35AF54CA49BEDBFBCBF05344F204065E106650A3EBB45AD1EB80

Function 00A73F6A Relevance: 4.6, APIs: 3, Instructions: 131
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,91B30C49,91B3098B), ref: 00A75022
RegOpenKeyA.ADVAPI32(80000002,91B3076C,91B3098B), ref: 00A75049
GetNativeSystemInfo.KERNELBASE(91B30B8B), ref: 00A750A0

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 05751ca6d2c52a59d9057e51fb6bbc09d2dfe9144b558038c6cf0043e7563ab1
Instruction ID: 80eb190bb4f941d8c3d192835b558b04f76c93f81aeba30d5871336c2f555e47
Opcode Fuzzy Hash: 05751ca6d2c52a59d9057e51fb6bbc09d2dfe9144b558038c6cf0043e7563ab1
Instruction Fuzzy Hash: 9D5185B280810EDFEB14DF24CC446AE77E4EF14311F11842EED8582A40EB764CA4DF5A

Function 008EEAF8 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008EF616

Strings

O~|w, xrefs: 008EEAF9
O~|w, xrefs: 008EEB07

Memory Dump Source

Source File: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: O~|w$O~|w
API String ID: 4275171209-2275773036
Opcode ID: a83193d5a2d60b8d8969f725f59912e128ecf889c62efb47cf501eba955e4b48
Instruction ID: 3bb357e21b8f22131f7fb9adc0f3a79162a1fb8413f9a12628f785b75629c7fd
Opcode Fuzzy Hash: a83193d5a2d60b8d8969f725f59912e128ecf889c62efb47cf501eba955e4b48
Instruction Fuzzy Hash: 680126B350854C8FE700BF79984856EBBE4FB48320F220A2EE9C1D3741DA315C10CB96

Function 00AB97E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00AB984A

Strings

\\?\, xrefs: 00AB98A5

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: bf1d2605ba73fdaef59fc7b17219cc185424e063c0eac4078e527531da9b42bc
Instruction ID: 34e1436efc094251faaf7802eca6a8da9ea9f656f53e32ca730728ddc750e2a3
Opcode Fuzzy Hash: bf1d2605ba73fdaef59fc7b17219cc185424e063c0eac4078e527531da9b42bc
Instruction Fuzzy Hash: 4E313936A00209BFDF329FA4CA09BDFBB7AFF48750F040155FA00A5162D7769A61DB91

Function 00ABAEF7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00ABAF5B

Strings

.dll, xrefs: 00ABAF18

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 2b8fd0683f6e5724cfee7affe72d29f615b724990d4334f8edb61a6cdf712688
Instruction ID: 1cbbab630274f0b1d2d87122796635125e704a7252e264b65cfe57381b6351bb
Opcode Fuzzy Hash: 2b8fd0683f6e5724cfee7affe72d29f615b724990d4334f8edb61a6cdf712688
Instruction Fuzzy Hash: 3DF01DB1604205BFDF149F64C985BEE3BADFF29350F108115FA1986153C731D551EA52

Function 00ABD984 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(015FE482,?,?,-119E5FEC,?,?,?,-119E5FEC,?), ref: 00ABDA36

Part of subcall function 00ABD936: IsBadWritePtr.KERNEL32(?,00000004), ref: 00ABD944

CreateFileA.KERNEL32(?,?,?,-119E5FEC,?,?,?,-119E5FEC,?), ref: 00ABDA56

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: e1489287a589e51f84a6130e1b08baa4bbdb8ed6879cec9cd6fd2be4037445c0
Instruction ID: 1d53e99d1238a44bde9a0bbeb2757d1ddbe8a45e76529c83b4bb7c66ffbee1a3
Opcode Fuzzy Hash: e1489287a589e51f84a6130e1b08baa4bbdb8ed6879cec9cd6fd2be4037445c0
Instruction Fuzzy Hash: 50113A3150414AFBDF22AF90CD05BDE7F79BF09344F104119F905654A2E37689B1EB51

Function 00ABD2F0 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

GetCurrentProcess.KERNEL32(-119E5FEC), ref: 00ABD2FD
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00ABD363

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: 8cfcb92d169ecffee9d3db7722a5e2316da4d4eb4f10faeac8a73afb1b063fef
Instruction ID: bf394a47ba7d8fe0cb3ecd25cce02d4564e136558b65be8f3fc4c0a8522ecfdd
Opcode Fuzzy Hash: 8cfcb92d169ecffee9d3db7722a5e2316da4d4eb4f10faeac8a73afb1b063fef
Instruction Fuzzy Hash: CD01FB3220014AFB8F22AFA4CD49CEE3F7DBF99350B004215FA0599013D735D462EB62

Function 00A66D38 Relevance: 1.6, APIs: 1, Instructions: 117
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A66D38

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3a6bfce75586b34c95e8eb26cb4cc28ef9438a510359dc93edf1fb0e8f33de68
Instruction ID: c861d6735c142e1387f89033ac485f78f7b526987cf41f61f82a05c347c21124
Opcode Fuzzy Hash: 3a6bfce75586b34c95e8eb26cb4cc28ef9438a510359dc93edf1fb0e8f33de68
Instruction Fuzzy Hash: 993170F250C300AFE7166F09ED817BAFBE9EB84330F22482DE7C542650E6365844969B

Function 00ABB96F Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00ABBA24

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f0366c4d04b79f6fb4e9c8a132b9c54ca4cca37a49104bba690cbce86cf42002
Instruction ID: 702c92154349fce5c544bd268556a8a2c586be9898312f9853ae3b9f8abf00b1
Opcode Fuzzy Hash: f0366c4d04b79f6fb4e9c8a132b9c54ca4cca37a49104bba690cbce86cf42002
Instruction Fuzzy Hash: 8E315071A10204BFEB209F54DD45FDEBBBCFB08314F10816AF614AA192C7B199919B60

Function 00A66E84 Relevance: 1.6, APIs: 1, Instructions: 100
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A66E84

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 432625e21bd16644cd37579fe3e770de7448e135a27dbf705f72b4aa8a34b625
Instruction ID: 767f0bbd63a96dabf6e6da6c5e87b5603efb4880b92063b7fd0696e09f050c17
Opcode Fuzzy Hash: 432625e21bd16644cd37579fe3e770de7448e135a27dbf705f72b4aa8a34b625
Instruction Fuzzy Hash: 373134B250C610AFD3026F59D8816BEFBF8FF5A320F16092DEAC493610D77658908B97

Function 00ABB18B Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00ABB20D

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e04d3926d65f25b99575e3f7a664d9cc7a0f5503dcd91935d0cb20c79c30d756
Instruction ID: 9d02481d22b7b09028d116217d5fd450860050b0a939f0436290cad487de9e48
Opcode Fuzzy Hash: e04d3926d65f25b99575e3f7a664d9cc7a0f5503dcd91935d0cb20c79c30d756
Instruction Fuzzy Hash: 73318F71650204BEEB309F64DC46FDEB7BCEB09724F208269F614AA1D2C7B1A5918B64

Function 053B0D42 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 053B0DCD

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9c49896a06418bac45dc9893049920f328d2ed8100e35d3790ab23ef702a1804
Instruction ID: 36283a75162041b728d071d78310b7c3ca3c811265bb0e01a1880f788432e030
Opcode Fuzzy Hash: 9c49896a06418bac45dc9893049920f328d2ed8100e35d3790ab23ef702a1804
Instruction Fuzzy Hash: 512134B6C002099FDB54CF99D884BDEFBB4FF88720F14861AD909AB244D774A940CBA4

Function 053B0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 053B0DCD

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 40992018b72944bc37e641702239cd142e569aad0eb42a30a0aa766ab47a8bdb
Instruction ID: e330de27be4115c941ea8ff4ac6a3477b4b248714db549806bcbbc2522e0139e
Opcode Fuzzy Hash: 40992018b72944bc37e641702239cd142e569aad0eb42a30a0aa766ab47a8bdb
Instruction Fuzzy Hash: B82132B6C002099FDB54CF99D884ADEFBB4FB88720F14861AD909AB244D774A940CBA4

Function 053B1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 053B1580

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: ae214fadfbefda54a8af3f204869628b106513c43fb48f497340409550b1c704
Instruction ID: 7878d7597f1446ae2f1a500ac9b0e9ffa323760f17ff57e83d0a4aee4705b3ae
Opcode Fuzzy Hash: ae214fadfbefda54a8af3f204869628b106513c43fb48f497340409550b1c704
Instruction Fuzzy Hash: F811D3B5904249DFDB10CF9AC584BDEFBF4EB48320F10842AE559A3650D778AA44CFA5

Function 053B1509 Relevance: 1.6, APIs: 1, Instructions: 53serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 053B1580

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 61f92e2434a30d11ffca5ee0339c270e9b082d0f3e6e8c1a9131cb6b575b42c6
Instruction ID: f88c4e31dc9fb5738f6460f7956683de2dd8de795bba7a74f68f88ade1cd3739
Opcode Fuzzy Hash: 61f92e2434a30d11ffca5ee0339c270e9b082d0f3e6e8c1a9131cb6b575b42c6
Instruction Fuzzy Hash: 111103B6D00249CFDB10CF9AC584BDEBBF4AF48320F10842AD519A3650D378AA44CFA1

Function 00ABE4BC Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-119E5FEC), ref: 00ABE543

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: 6bf64f68eff26121c9c77ee8cd3306cc8a4dd20bab5f998343362de2e4153e53
Instruction ID: 389df6a8f2c0001292873516a8e35dbc7f8ba7a87ace227cc0e663955131f6ee
Opcode Fuzzy Hash: 6bf64f68eff26121c9c77ee8cd3306cc8a4dd20bab5f998343362de2e4153e53
Instruction Fuzzy Hash: A0119D7250010AEFCF22AFA4DD0ADEA3B6EAF59344B008615FA0655022D736C5B2EB61

Function 00ABE2A4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6771f9e9d9cb220907932ec198d6f940b55a21b626e80829dc24dc94e3493d31
Instruction ID: f9d96ffa132e9e3497c6a491ca2135c17c4b45ec4da8cd61b4814218452a699a
Opcode Fuzzy Hash: 6771f9e9d9cb220907932ec198d6f940b55a21b626e80829dc24dc94e3493d31
Instruction Fuzzy Hash: 74115B3250020AEFCF16EFA4C90AEDE3BBDAF44340F188415FA159A163C779C965EB61

Function 053B1301 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 053B1367

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: c53feace88b3ed5fa1ce235c670b1390b5a82a3bd6b70586b6e8f0b6bd67ecdc
Instruction ID: cad7c89fae768fa4785a282ecd5ce2b485596d4abbb7dba27375264c2f299374
Opcode Fuzzy Hash: c53feace88b3ed5fa1ce235c670b1390b5a82a3bd6b70586b6e8f0b6bd67ecdc
Instruction Fuzzy Hash: A71143B1800249CFDB10CF9AC884BDEBBF4EF48720F10842AD518A3650D778A940CFA1

Function 053B1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 053B1367

Memory Dump Source

Source File: 00000000.00000002.2496377945.00000000053B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53b0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 7638dc44650bb82d28f5f8bca8ee2cfb21f49845c99e897fee272afbbac4ad14
Instruction ID: 7f92a90825075edaa7df0a57ca89396ab56b26de6aab0b3ed9f72fbc34b8abf2
Opcode Fuzzy Hash: 7638dc44650bb82d28f5f8bca8ee2cfb21f49845c99e897fee272afbbac4ad14
Instruction Fuzzy Hash: C11133B1804249CFDB10CF9AC944BEEFBF8EF48720F10846AD518A3650D778A984CFA5

Function 00ABDB88 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-119E5FEC,?,?,00ABB8B7,?,?,00000400,?,00000000,?,00000000), ref: 00ABDBF4

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: f597faceda809ecaf7efa65d9c750ea9ea2deec9bfdb2a4017a21e1e4179460d
Instruction ID: 71e3d4f3b9f4fcbdfcc09712919039119727882f05a8f7e52be6b44641e0e624
Opcode Fuzzy Hash: f597faceda809ecaf7efa65d9c750ea9ea2deec9bfdb2a4017a21e1e4179460d
Instruction Fuzzy Hash: 11F0C93220414AFBCF126FA8C909EDE3F6EFF4A344F054121F60559022D772D4A1EB61

Function 00A69172 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 47d6156d56e94ca10ebfef302bf36ead724ff041d1aef644792655884287e80e
Instruction ID: d9ac2d08407e3db304ae2ddeb917fe230ae6a7614dac5f6fb5c3831970070012
Opcode Fuzzy Hash: 47d6156d56e94ca10ebfef302bf36ead724ff041d1aef644792655884287e80e
Instruction Fuzzy Hash: 4FF0E5F20842472EE202ABB58A1DAAF7B3CDB43230B3186AEF804D7542E2B55D450265

Function 00AB9406 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00AB946A

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 7cf83a482cae412b21e09941299e00a1149f97e6fb69b4d422e46ba867c595e3
Instruction ID: 1cf583f1e4656f8adc56b56724fb8aef34c203fd98ad4d3fcad3223ecff5d357
Opcode Fuzzy Hash: 7cf83a482cae412b21e09941299e00a1149f97e6fb69b4d422e46ba867c595e3
Instruction Fuzzy Hash: 4301E831A00509BFDF219FA5CC45DDEBF7AEF88340F0041A5E914A4061E7338A62DF61

Function 00ABBF89 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

CloseHandle.KERNELBASE(00ABB94C,-119E5FEC,?,?,00ABB94C,?), ref: 00ABBFC7

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: ab3d122641e255d577ee71282675d7c7eaf3f8da5a9960212fb35f02d533aca0
Instruction ID: 2e74c6fdc2f7849b3160a0e202284c232976bf510db16c6e644fd6612ae6af1c
Opcode Fuzzy Hash: ab3d122641e255d577ee71282675d7c7eaf3f8da5a9960212fb35f02d533aca0
Instruction Fuzzy Hash: 29E04F72604446BACE207B78CE0ADEF6E2DAFD5394F000122B60595053DB71C0A2D675

Function 008EE5F6 Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008EF5FB

Memory Dump Source

Source File: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 627b9c75245bd26d6e4c245b80c6b476b9fb637e167445e35b3ec40192b2b2d5
Instruction ID: 3bcbf81f0a4b82827504dfebd3604f74282f995e4c22c376aa5d32fc6cb69dd2
Opcode Fuzzy Hash: 627b9c75245bd26d6e4c245b80c6b476b9fb637e167445e35b3ec40192b2b2d5
Instruction Fuzzy Hash: C4E092B122C689CADB40AF3581856AABBF4FB21305F11082A9DC1CA151D2315860DB46

Function 00ABB04E Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00AB90D4,?,?), ref: 00ABB054

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fb6e3f1408ded3a7b081bbed3e8ea6bdd966a1d73d92c654251bf3f43cbacb31
Instruction ID: b03b51de82ff1ea681542db6d7ca05cb345d1bc32cb379ac96313707e15d0d2b
Opcode Fuzzy Hash: fb6e3f1408ded3a7b081bbed3e8ea6bdd966a1d73d92c654251bf3f43cbacb31
Instruction Fuzzy Hash: CAB09231100109BBCF11BF65DD06C8DBF6DFF2A3A8B008121F905480228B72EA60ABE2

Non-executed Functions

Function 00ABD382 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

GetSystemTime.KERNEL32(?,-119E5FEC), ref: 00ABD3B7
GetFileTime.KERNEL32(?,?,?,?,-119E5FEC), ref: 00ABD3FA

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: 45411ce9d9314b3c5443a859ce87bc792b5af0027139d09e73190713da02186c
Instruction ID: 566d8aa0e53568ac2329308b0d11c11f2c4b6e0cbaf232de98aebfd13eba1783
Opcode Fuzzy Hash: 45411ce9d9314b3c5443a859ce87bc792b5af0027139d09e73190713da02186c
Instruction Fuzzy Hash: 6901163220404AFBCF215F29D908EDEBF79FF86310B104622F50695062DB7298A2DB61

Function 00ABE240 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00ABE287

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 0776b10c77703c4a92cc5f150af499954ffa1b9f25270d252b5d95b869d5c12c
Instruction ID: d56cd6cee2a4be1a8448426dd6fa849b2502239ae99893a8ddc85e66891bdb77
Opcode Fuzzy Hash: 0776b10c77703c4a92cc5f150af499954ffa1b9f25270d252b5d95b869d5c12c
Instruction Fuzzy Hash: 4EF0F83260020AFFCF01CFA4D904ACC7BB5FF09345B108125F91596121D375DA61EF44

Function 00A66B86 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

e6?, xrefs: 00A66C5A

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID: e6?
API String ID: 0-1619617767
Opcode ID: f4c8b34ee272c6f6cd36e06f315bb58a8b6ee5585dbf96c81f771a14761473e9
Instruction ID: d6ac2eee97e54aa4fdce47d16189aad3fb5c378eed5f481e3bc02ebbc3328bf2
Opcode Fuzzy Hash: f4c8b34ee272c6f6cd36e06f315bb58a8b6ee5585dbf96c81f771a14761473e9
Instruction Fuzzy Hash: E65181B250D7809FD702AF28C8916AAFFF4FF56300F0A89AED2C48B651D6359454CB93

Function 00A66C03 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

e6?, xrefs: 00A66C5A

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID: e6?
API String ID: 0-1619617767
Opcode ID: ae6a4f73102f6a5aa2d4d9ea75f8ce6a012e458ed8de68b321fb89c74446f2fa
Instruction ID: f5d818547035c8022d1f3aec5bb0ddca8527e0ae510c8c22b7e7927a1def9b1d
Opcode Fuzzy Hash: ae6a4f73102f6a5aa2d4d9ea75f8ce6a012e458ed8de68b321fb89c74446f2fa
Instruction Fuzzy Hash: C541C2B250D740AFD702AF28C8916AABFF4FF96300F0A896EE2C487651D6359444CB93

Function 00A6AE0B Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc5f24777a63b8b4754618790d4c4dd98d3751254f909f9193fbde9eff2374
Instruction ID: ffe0b4589999635b79cf7b9339c647e82eb291abac485a79591e20d76df785a0
Opcode Fuzzy Hash: afcc5f24777a63b8b4754618790d4c4dd98d3751254f909f9193fbde9eff2374
Instruction Fuzzy Hash: A751986294D3C29FD7138B7498B1695BFB0AE6B31030D86DBC1D0CF5A3D318984AEB52

Function 00A6AE8D Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0c8cc428684a6e525f8d988a02a138659b38bac897581741861c202c8ee077
Instruction ID: 61b4fef88b7f2c72f386db6b9fe5766569faeb8b3967ddf2603a110895d46ebf
Opcode Fuzzy Hash: 7c0c8cc428684a6e525f8d988a02a138659b38bac897581741861c202c8ee077
Instruction Fuzzy Hash: F941536250D7D29FC713CB7498A1295BFB0BE5B30030D86DBC1D18B5A3D718944AEB62

Function 00A7AF36 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518d54c0f68786b8a03b6b5f39f13bc386c7cfba9b6075858dc99cca09098494
Instruction ID: 8ce704dedd3ba217ebe4c9f6c7dd27b49bf5ba79610e678fb1ad6b6ffdb2ad86
Opcode Fuzzy Hash: 518d54c0f68786b8a03b6b5f39f13bc386c7cfba9b6075858dc99cca09098494
Instruction Fuzzy Hash: 81E04676104101AADB00AF54C85999FFBF8FF59321F21D84AF888CB726C2358D41CB2A

Function 00ABC8B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9235: GetCurrentThreadId.KERNEL32 ref: 00AB9244

Part of subcall function 00ABD936: IsBadWritePtr.KERNEL32(?,00000004), ref: 00ABD944

wsprintfA.USER32 ref: 00ABC8FE
LoadImageA.USER32(?,?,?,?,?,?), ref: 00ABC9C2

Strings

%8x, xrefs: 00ABC98C, 00ABC9BF
%8x, xrefs: 00ABC8F9, 00ABC8FC

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: ac9334d048c000a3c38dd187774b892c8f68cf379309f75c9d220af714ca2a65
Instruction ID: 1cb7ef8af8b5f48c67aebf3af2d1e4f3d9507af8929165bc8bf77f5154ae678e
Opcode Fuzzy Hash: ac9334d048c000a3c38dd187774b892c8f68cf379309f75c9d220af714ca2a65
Instruction Fuzzy Hash: C8312A31A0010AFFDF119F94DD09EEEBB79FF88710F108126F511A6161D7319A61DB51

Function 00ABD489 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(015FE482,00004020,00000000,-119E5FEC), ref: 00ABD576

Strings

@, xrefs: 00ABD4B5

Memory Dump Source

Source File: 00000000.00000002.2487576745.0000000000AB4000.00000040.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.2485849792.00000000008E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485880190.00000000008E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485906301.00000000008E6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485928471.00000000008EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2485980156.00000000008F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486206833.0000000000A48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486268814.0000000000A4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486301241.0000000000A70000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486457579.0000000000A78000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486484547.0000000000A7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2486572587.0000000000A83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487410286.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487467205.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487485679.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487506502.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487529651.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487557135.0000000000AA8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487597224.0000000000ABF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487615723.0000000000AC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487630195.0000000000AC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487647151.0000000000AC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487662801.0000000000AD3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487676736.0000000000AD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487692646.0000000000AE1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487712061.0000000000AE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487727142.0000000000AE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487741601.0000000000AE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487757763.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487779992.0000000000AF9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487798941.0000000000AFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487814360.0000000000AFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487828458.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487874157.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487890073.0000000000B07000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487905134.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487919447.0000000000B0D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487932952.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487946273.0000000000B0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487966851.0000000000B10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487980683.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2487999466.0000000000B18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488016389.0000000000B28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488029857.0000000000B29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488042199.0000000000B2A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488077878.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488105336.0000000000B76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488182340.0000000000B84000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2488195614.0000000000B86000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: c9eecb362e628c79d3d560e77c05709a8e1b74ce5a26f61c3af9b514ec4faf50
Instruction ID: 8c0e3cb6f363df8a7eb920b1ec9451c77bbe0d938ee3a1863725ba8e920e940d
Opcode Fuzzy Hash: c9eecb362e628c79d3d560e77c05709a8e1b74ce5a26f61c3af9b514ec4faf50
Instruction Fuzzy Hash: 23318DB1904305EFCF258F44C844BDABBB8FF08314F10861AE55967262D375A6A5CB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 6476, Parent PID: 4088

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 6476, Parent PID: 4088COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
file.exe

Function 00ABA908 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00ABAE0E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00ABD768 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00A73F6A Relevance: 4.6, APIs: 3, Instructions: 131
registryCOMMON

Function 008EEAF8 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 44
memoryCOMMON

Function 00AB97E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00ABAEF7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00ABD984 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00ABD2F0 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00A66D38 Relevance: 1.6, APIs: 1, Instructions: 117
libraryCOMMON

Function 00ABB96F Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00A66E84 Relevance: 1.6, APIs: 1, Instructions: 100
libraryCOMMON

Function 00ABB18B Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 053B0D42 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 053B0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON