Edit tour

Windows Analysis Report
uw7vXaPNPF.exe

Overview

General Information

Sample name:	uw7vXaPNPF.exe renamed because original name is a hash value
Original sample name:	0f57c7a8b420e451c9f4dfe710d0dcd3.exe
Analysis ID:	1579678
MD5:	0f57c7a8b420e451c9f4dfe710d0dcd3
SHA1:	ce586063030b771b50e0527f02ab8c11e75901b5
SHA256:	bc3b18240bfa7834a398945b207b76c4445be32e590ef8459b41e4423f737ad3
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uw7vXaPNPF.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\uw7vXaPNPF.exe" MD5: 0F57C7A8B420E451C9F4DFE710D0DCD3)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: uw7vXaPNPF.exe	ReversingLabs: Detection: 60%
Source: uw7vXaPNPF.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uw7vXaPNPF.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_00BB53AB CryptVerifySignatureA,

0_2_00BB53AB

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: uw7vXaPNPF.exe, 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: uw7vXaPNPF.exe	Static PE information: section name:
Source: uw7vXaPNPF.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_009DDDA4	0_2_009DDDA4
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61EDF	0_2_00B61EDF
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61F01	0_2_00B61F01

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: String function: 00BB03A0 appears 35 times

Source: uw7vXaPNPF.exe, 00000000.00000000.1342315652.00000000009D6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uw7vXaPNPF.exe
Source: uw7vXaPNPF.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs uw7vXaPNPF.exe

Source: uw7vXaPNPF.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_050915D0 ChangeServiceConfigA,

0_2_050915D0

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uw7vXaPNPF.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uw7vXaPNPF.exe	ReversingLabs: Detection: 60%
Source: uw7vXaPNPF.exe	Virustotal: Detection: 61%

Source: uw7vXaPNPF.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: uw7vXaPNPF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: uw7vXaPNPF.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Section loaded: sspicli.dll	Jump to behavior

Source: uw7vXaPNPF.exe

Static file information: File size 2814464 > 1048576

Source: uw7vXaPNPF.exe

Static PE information: Raw size of yyhljryf is bigger than: 0x100000 < 0x2a6400

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: uw7vXaPNPF.exe, 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Unpacked PE file: 0.2.uw7vXaPNPF.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W;yyhljryf:EW;ddvyecmu:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: uw7vXaPNPF.exe

Static PE information: real checksum: 0x2b2552 should be: 0x2b46b7

Source: uw7vXaPNPF.exe	Static PE information: section name:
Source: uw7vXaPNPF.exe	Static PE information: section name: .idata
Source: uw7vXaPNPF.exe	Static PE information: section name: yyhljryf
Source: uw7vXaPNPF.exe	Static PE information: section name: ddvyecmu
Source: uw7vXaPNPF.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B710CF push 68D6A77Ah; mov dword ptr [esp], ebp	0_2_00B707E9
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6F6F5 push esi; mov dword ptr [esp], 340913D7h	0_2_00B72A05
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61988 push 38E50907h; mov dword ptr [esp], eax	0_2_00B619C9
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61988 push 42A7E3DBh; mov dword ptr [esp], eax	0_2_00B61A37
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61988 push ebp; mov dword ptr [esp], eax	0_2_00B61A99
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61AD0 push ebp; mov dword ptr [esp], 3F59B4A8h	0_2_00B61B13
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61AD0 push ebp; mov dword ptr [esp], edx	0_2_00B61B48
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B61AD0 push eax; mov dword ptr [esp], ebx	0_2_00B61B5F
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_009DED09 push 5E6A1688h; mov dword ptr [esp], ebx	0_2_009DEED2
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B620B7 push edx; mov dword ptr [esp], edi	0_2_00B620D9
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B620B7 push 5AA7DD75h; mov dword ptr [esp], edi	0_2_00B620F2
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B620B7 push ecx; mov dword ptr [esp], esi	0_2_00B62107
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B620B7 push ebx; mov dword ptr [esp], edx	0_2_00B6211E
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6F0A6 push edi; mov dword ptr [esp], ebp	0_2_00B6F0D8
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00BE30A6 push 17556359h; mov dword ptr [esp], edx	0_2_00BE30D0
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B5F0AA push 2B53CDFDh; mov dword ptr [esp], edx	0_2_00B5F311
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B5F0AA push edx; mov dword ptr [esp], 7FE37B00h	0_2_00B5F31C
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00C340E6 push edi; mov dword ptr [esp], edx	0_2_00C340FD
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00C340E6 push ecx; mov dword ptr [esp], 3DFE6B38h	0_2_00C34101
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6209F push ecx; mov dword ptr [esp], esi	0_2_00B62107
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6209F push ebx; mov dword ptr [esp], edx	0_2_00B6211E
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00C270EC push ebp; mov dword ptr [esp], edi	0_2_00C27100
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6208C push edx; mov dword ptr [esp], edi	0_2_00B620D9
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6208C push 5AA7DD75h; mov dword ptr [esp], edi	0_2_00B620F2
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6208C push ecx; mov dword ptr [esp], esi	0_2_00B62107
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B6208C push ebx; mov dword ptr [esp], edx	0_2_00B6211E
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_009E10DB push edi; mov dword ptr [esp], ecx	0_2_009E10E1
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B700D5 push esi; mov dword ptr [esp], 7FFA2DA9h	0_2_00B72820
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B5F0DC push edi; mov dword ptr [esp], edx	0_2_00B5F6B0
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_009DC0EF push 7DB724CBh; mov dword ptr [esp], edi	0_2_009DC4EE
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Code function: 0_2_00B5F035 push 3EE63E50h; mov dword ptr [esp], edx	0_2_00B5F03A

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B627BB second address: B627C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B619A8 second address: B619AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B61D80 second address: B61D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B61EE8 second address: B61EEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B61EEE second address: B61EF3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B61EF3 second address: B61F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB12CBAF1B0h 0x0000000c jp 00007FB12CBAF1A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B64F15 second address: B64F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B64FD8 second address: B64FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B64FDE second address: B64FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B650EA second address: B650EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B650EF second address: B65134 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB12CBDA244h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xor dword ptr [ebp+122D26BDh], esi 0x00000013 push 00000000h 0x00000015 mov si, 4AF3h 0x00000019 call 00007FB12CBDA239h 0x0000001e jne 00007FB12CBDA23Eh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B65134 second address: B6514C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B6514C second address: B6516B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB12CBDA236h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push esi 0x00000014 jl 00007FB12CBDA236h 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B6516B second address: B6516F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B6516F second address: B65192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA247h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B65192 second address: B65197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B652C9 second address: B652E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB12CBDA244h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8345E second address: B83463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B83463 second address: B83477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB12CBDA23Ah 0x00000009 jl 00007FB12CBDA236h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8357D second address: B8358F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1ACh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8358F second address: B83593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B83593 second address: B83599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B839AF second address: B839D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB12CBDA249h 0x00000008 js 00007FB12CBDA236h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B83B7F second address: B83B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84271 second address: B84284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a je 00007FB12CBDA236h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8450C second address: B84510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B77EA3 second address: B77EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB12CBDA236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84C9A second address: B84C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84C9E second address: B84CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84CA2 second address: B84CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84CAC second address: B84CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB12CBDA236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84CB6 second address: B84CC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84F69 second address: B84F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84F79 second address: B84F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84F7F second address: B84F93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B84F93 second address: B84F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB12CBAF1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853CA second address: B853CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853CE second address: B853E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FB12CBAF1A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853E0 second address: B853E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853E4 second address: B853EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853EA second address: B853F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853F0 second address: B853F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B853F6 second address: B853FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8645D second address: B86461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B86C6E second address: B86C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FB12CBDA23Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B86C94 second address: B86C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B87D06 second address: B87D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007FB12CBDA240h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007FB12CBDA236h 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB12CBDA240h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8F5EB second address: B8F5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8F5EF second address: B8F5F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8F5F9 second address: B8F5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8F76A second address: B8F785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007FB12CBDA23Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FB12CBDA236h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8F785 second address: B8F789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FD4C second address: B8FD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB12CBDA242h 0x0000000e jmp 00007FB12CBDA245h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FD7C second address: B8FDAD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB12CBAF1ACh 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB12CBAF1B8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FDAD second address: B8FDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FDB3 second address: B8FDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FDB9 second address: B8FDC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FF94 second address: B8FF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B8FF9A second address: B8FFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B91645 second address: B9164B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9164B second address: B9164F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B917B6 second address: B917BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B917BB second address: B917C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B917C1 second address: B917C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B91B8F second address: B91B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB12CBDA236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B924BD second address: B924C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB12CBAF1A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9257D second address: B92587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB12CBDA236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92587 second address: B9258B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92646 second address: B9264C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92800 second address: B92804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92804 second address: B9280A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9280A second address: B92825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92825 second address: B92829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92F51 second address: B92F55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B92F55 second address: B92F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx esi, di 0x0000000d mov edi, dword ptr [ebp+122D2259h] 0x00000013 push 00000000h 0x00000015 movsx edi, si 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b mov edi, 201123D6h 0x00000020 stc 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jng 00007FB12CBDA23Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B941E4 second address: B941FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B941FB second address: B941FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B941FF second address: B94203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9628D second address: B96293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B96293 second address: B962A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007FB12CBAF1AEh 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B96DCE second address: B96DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B96DD3 second address: B96E18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e jmp 00007FB12CBAF1AFh 0x00000013 push 00000000h 0x00000015 mov esi, 3C2481A9h 0x0000001a jmp 00007FB12CBAF1ABh 0x0000001f push eax 0x00000020 pushad 0x00000021 pushad 0x00000022 push edi 0x00000023 pop edi 0x00000024 jnl 00007FB12CBAF1A6h 0x0000002a popad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B977C4 second address: B97855 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jng 00007FB12CBDA243h 0x00000016 nop 0x00000017 jnp 00007FB12CBDA24Fh 0x0000001d jbe 00007FB12CBDA249h 0x00000023 mov dword ptr [ebp+124665A8h], ebx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FB12CBDA238h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 00000015h 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 push eax 0x00000046 adc si, CA8Fh 0x0000004b pop esi 0x0000004c push 00000000h 0x0000004e xor esi, dword ptr [ebp+122D3B5Ah] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB12CBDA247h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B97551 second address: B97555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B98172 second address: B9818D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB12CBDA23Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FB12CBDA236h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9818D second address: B98193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B98193 second address: B98199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B98199 second address: B981D7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB12CBAF1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D3A66h] 0x00000013 mov esi, eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 mov edi, dword ptr [ebp+122D3A92h] 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edi 0x00000022 jmp 00007FB12CBAF1ADh 0x00000027 pop edi 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f jns 00007FB12CBAF1A6h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B981D7 second address: B981DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B981DC second address: B981E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9890A second address: B98932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007FB12CBDA24Dh 0x0000000e jmp 00007FB12CBDA247h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9C712 second address: B9C718 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E611 second address: B9E615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E615 second address: B9E61B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9D7CD second address: B9D851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA241h 0x00000009 popad 0x0000000a pop ebx 0x0000000b nop 0x0000000c cld 0x0000000d push dword ptr fs:[00000000h] 0x00000014 xor dword ptr [ebp+12480AD7h], ebx 0x0000001a and edi, 1D5F8FA1h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 js 00007FB12CBDA23Ch 0x0000002d mov dword ptr [ebp+122D26EEh], edx 0x00000033 mov eax, dword ptr [ebp+122D0991h] 0x00000039 mov ebx, esi 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007FB12CBDA238h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FB12CBDA244h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E61B second address: B9E6AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D209Bh] 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 je 00007FB12CBAF1BFh 0x00000019 jmp 00007FB12CBAF1B9h 0x0000001e call 00007FB12CBAF1B9h 0x00000023 push ecx 0x00000024 pop eax 0x00000025 pop edi 0x00000026 popad 0x00000027 push 00000000h 0x00000029 xor ebx, 44857873h 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 push ecx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ecx 0x00000035 jno 00007FB12CBAF1B0h 0x0000003b popad 0x0000003c push eax 0x0000003d pushad 0x0000003e jmp 00007FB12CBAF1B1h 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E8BE second address: B9E8C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E8C2 second address: B9E8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9E8C8 second address: B9E8CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA0776 second address: BA0782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA0782 second address: BA0786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA1753 second address: BA176B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA26C1 second address: BA26C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA26C5 second address: BA272A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FB12CBAF1A8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 js 00007FB12CBAF1A9h 0x00000029 mov di, dx 0x0000002c movzx edi, dx 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D37DCh], eax 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c call 00007FB12CBAF1A8h 0x00000041 pop edx 0x00000042 mov dword ptr [esp+04h], edx 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc edx 0x0000004f push edx 0x00000050 ret 0x00000051 pop edx 0x00000052 ret 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push esi 0x00000058 pop esi 0x00000059 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA272A second address: BA2734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA2895 second address: BA293A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FB12CBAF1B8h 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 popad 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D263Ah], ecx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f call 00007FB12CBAF1B8h 0x00000024 mov dword ptr [ebp+122D2C11h], edx 0x0000002a pop ebx 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FB12CBAF1A8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c or dword ptr [ebp+122D338Bh], ecx 0x00000052 mov eax, dword ptr [ebp+122D0245h] 0x00000058 mov ebx, dword ptr [ebp+122D3A56h] 0x0000005e add dword ptr [ebp+12474034h], ebx 0x00000064 push FFFFFFFFh 0x00000066 jng 00007FB12CBAF1ACh 0x0000006c mov dword ptr [ebp+122D312Bh], ebx 0x00000072 push eax 0x00000073 pushad 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA293A second address: BA2940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA2940 second address: BA294D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FB12CBAF1ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA3717 second address: BA377F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FB12CBDA238h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 jmp 00007FB12CBDA243h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB12CBDA238h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 sub dword ptr [ebp+12473F73h], ebx 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA377F second address: BA3789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA3789 second address: BA378D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA378D second address: BA3791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA38F4 second address: BA38FE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB12CBDA23Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA38FE second address: BA3982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 add edi, 66B62981h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 xor di, 46F0h 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007FB12CBAF1A8h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a jnc 00007FB12CBAF1ACh 0x00000040 mov eax, dword ptr [ebp+122D127Dh] 0x00000046 mov dword ptr [ebp+122D3857h], ebx 0x0000004c push FFFFFFFFh 0x0000004e mov ebx, dword ptr [ebp+1248731Ch] 0x00000054 mov bh, F1h 0x00000056 nop 0x00000057 pushad 0x00000058 jl 00007FB12CBAF1B4h 0x0000005e jmp 00007FB12CBAF1AEh 0x00000063 pushad 0x00000064 jmp 00007FB12CBAF1ADh 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA79B3 second address: BA79B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA79B7 second address: BA7A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 or edi, 1835EA16h 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D30C9h], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FB12CBAF1A8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 jmp 00007FB12CBAF1B7h 0x00000037 xchg eax, esi 0x00000038 ja 00007FB12CBAF1B4h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jc 00007FB12CBAF1ACh 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA7A2A second address: BA7A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA7A2E second address: BA7A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA7A33 second address: BA7A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA8A05 second address: BA8A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA8A09 second address: BA8A13 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA8A13 second address: BA8A38 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB12CBAF1B0h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FB12CBAF1ACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA8A38 second address: BA8AD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA247h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FB12CBDA238h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 xor bl, 0000005Dh 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FB12CBDA238h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push edi 0x00000048 call 00007FB12CBDA238h 0x0000004d pop edi 0x0000004e mov dword ptr [esp+04h], edi 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc edi 0x0000005b push edi 0x0000005c ret 0x0000005d pop edi 0x0000005e ret 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jnl 00007FB12CBDA238h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA7C8A second address: BA7C98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9C36 second address: BA9C3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9C3C second address: BA9C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9C42 second address: BA9C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9C46 second address: BA9C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jnl 00007FB12CBAF1A6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9C59 second address: BA9CFE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB12CBDA23Bh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D37B8h], edi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FB12CBDA238h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 call 00007FB12CBDA243h 0x00000038 push ecx 0x00000039 mov ebx, dword ptr [ebp+12459A30h] 0x0000003f pop ebx 0x00000040 pop edi 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 mov eax, dword ptr [ebp+122D03E9h] 0x0000004e push 00000000h 0x00000050 push esi 0x00000051 call 00007FB12CBDA238h 0x00000056 pop esi 0x00000057 mov dword ptr [esp+04h], esi 0x0000005b add dword ptr [esp+04h], 00000017h 0x00000063 inc esi 0x00000064 push esi 0x00000065 ret 0x00000066 pop esi 0x00000067 ret 0x00000068 mov edi, 3F1A9BC5h 0x0000006d push FFFFFFFFh 0x0000006f xor dword ptr [ebp+122D35D5h], edi 0x00000075 push edi 0x00000076 mov edi, dword ptr [ebp+122D3BDEh] 0x0000007c pop edi 0x0000007d nop 0x0000007e push edi 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BA9CFE second address: BA9D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB12CBAF1A6h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BAB9D3 second address: BAB9F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FB12CBDA248h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BACDD8 second address: BACDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBAD7E second address: BBAD82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBAD82 second address: BBAD88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBAEB3 second address: BBAED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA243h 0x00000009 pop esi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBAED4 second address: BBAEDE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB12CBAF1A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBAEDE second address: BBAEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB12CBDA238h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBB071 second address: BBB097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB12CBAF1B9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBB097 second address: BBB09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BBB09D second address: BBB0A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC1B9B second address: BC1BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 jl 00007FB12CBDA23Ah 0x0000001f push ecx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a pop eax 0x0000002b jmp 00007FB12CBDA23Fh 0x00000030 popad 0x00000031 pushad 0x00000032 js 00007FB12CBDA236h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC808A second address: BC809B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7399 second address: BC73B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB12CBDA242h 0x00000008 jmp 00007FB12CBDA23Ch 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC776D second address: BC7777 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB12CBAF1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7777 second address: BC77C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB12CBDA236h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jnc 00007FB12CBDA236h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FB12CBDA23Ah 0x0000001e jmp 00007FB12CBDA23Bh 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push eax 0x00000026 pop eax 0x00000027 popad 0x00000028 jg 00007FB12CBDA253h 0x0000002e jmp 00007FB12CBDA247h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC77C9 second address: BC77CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC794D second address: BC7952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7952 second address: BC7978 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB12CBAF1BEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7BDF second address: BC7BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7BE3 second address: BC7BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FB12CBAF1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BC7BEF second address: BC7BF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B4A337 second address: B4A33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B4A33B second address: B4A34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB12CBDA23Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF2B9 second address: BCF2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF2BD second address: BCF2C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF593 second address: BCF5AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B5h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF5AE second address: BCF5B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF8A0 second address: BCF8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB12CBAF1A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF8B1 second address: BCF8B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF8B5 second address: BCF8D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FB12CBAF1A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCF8D6 second address: BCF8F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Bh 0x00000007 jmp 00007FB12CBDA240h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCFA54 second address: BCFA86 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB12CBAF1A6h 0x00000008 jmp 00007FB12CBAF1B4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB12CBAF1ADh 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCFBEF second address: BCFC31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB12CBDA23Ah 0x00000008 jg 00007FB12CBDA236h 0x0000000e jmp 00007FB12CBDA246h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FB12CBDA245h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BCFF01 second address: BCFF2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007FB12CBAF1B8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jl 00007FB12CBAF1A6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD07BE second address: BD07C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD3A05 second address: BD3A09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD3A09 second address: BD3A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FB12CBDA236h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD3A19 second address: BD3A1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD3A1F second address: BD3A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8279 second address: BD827D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD827D second address: BD8283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8283 second address: BD828F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB12CBAF1AEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD828F second address: BD829B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB12CBDA23Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD829B second address: BD82A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD82A7 second address: BD82B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD82B0 second address: BD82B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8591 second address: BD8597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8981 second address: BD8987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8987 second address: BD89E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FB12CBDA246h 0x0000000a pushad 0x0000000b jmp 00007FB12CBDA23Ah 0x00000010 jmp 00007FB12CBDA23Dh 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB12CBDA245h 0x0000001f jmp 00007FB12CBDA244h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BD8CE3 second address: BD8CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB12CBAF1ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD60E second address: BDD61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA23Ah 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD61F second address: BDD629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB12CBAF1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD629 second address: BDD645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA245h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD645 second address: BDD64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B46C7B second address: B46C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA245h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B992EC second address: B992F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B998C0 second address: B9992A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB12CBDA238h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FB12CBDA23Eh 0x00000011 jo 00007FB12CBDA238h 0x00000017 pushad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d ja 00007FB12CBDA243h 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 jc 00007FB12CBDA24Bh 0x0000002c jmp 00007FB12CBDA245h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FB12CBDA248h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99AA3 second address: B99AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB12CBAF1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99AAD second address: B99ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FB12CBDA236h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99ACC second address: B99AD6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB12CBAF1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99AD6 second address: B99ADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99ADC second address: B99AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99E09 second address: B99E22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA245h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99E22 second address: B99E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A271 second address: B9A2B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FB12CBDA238h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 movzx edx, ax 0x00000025 push 0000001Eh 0x00000027 mov dword ptr [ebp+122D37E1h], edx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jne 00007FB12CBDA238h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A3AD second address: B9A3B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A3B3 second address: B9A3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A616 second address: B9A62C instructions: 0x00000000 rdtsc 0x00000002 je 00007FB12CBAF1A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A62C second address: B9A6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA249h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB12CBDA238h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jmp 00007FB12CBDA244h 0x0000002a lea eax, dword ptr [ebp+1248EF9Fh] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FB12CBDA238h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a jmp 00007FB12CBDA23Ah 0x0000004f mov ecx, dword ptr [ebp+122D3399h] 0x00000055 nop 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a pop eax 0x0000005b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A6BB second address: B9A725 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FB12CBAF1A8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edi 0x00000011 jmp 00007FB12CBAF1B8h 0x00000016 pop edi 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FB12CBAF1A8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 xor dword ptr [ebp+122D1F9Eh], eax 0x00000038 lea eax, dword ptr [ebp+1248EF5Bh] 0x0000003e jg 00007FB12CBAF1ABh 0x00000044 nop 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 push ecx 0x00000049 pop ecx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A725 second address: B9A741 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA245h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A741 second address: B789D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FB12CBAF1B7h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FB12CBAF1A8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 or dword ptr [ebp+1246BBA2h], edx 0x0000002d call dword ptr [ebp+122D33AEh] 0x00000033 push eax 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDC837 second address: BDC83D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDC83D second address: BDC843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDC9A0 second address: BDC9AA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDCB27 second address: BDCB3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB12CBAF1ADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDCB3E second address: BDCB7E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB12CBDA23Ch 0x00000008 jg 00007FB12CBDA247h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB12CBDA247h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD1E6 second address: BDD1EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BDD1EA second address: BDD20A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FB12CBDA236h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FB12CBDA23Ch 0x00000012 jne 00007FB12CBDA23Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE324A second address: BE3265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1B4h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE3265 second address: BE326B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE326B second address: BE3271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE33EF second address: BE33F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE33F3 second address: BE33FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB12CBAF1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE33FF second address: BE341D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB12CBDA248h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE341D second address: BE3421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE3421 second address: BE342A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE5ADB second address: BE5B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1AFh 0x00000009 je 00007FB12CBAF1A6h 0x0000000f popad 0x00000010 jng 00007FB12CBAF1BCh 0x00000016 jmp 00007FB12CBAF1B6h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE995E second address: BE99A8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007FB12CBDA236h 0x00000009 jmp 00007FB12CBDA247h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FB12CBDA23Ah 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FB12CBDA242h 0x00000020 popad 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE99A8 second address: BE99AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE99AF second address: BE99B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE9C6B second address: BE9C73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE9DF0 second address: BE9DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE9DF6 second address: BE9DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE9DFC second address: BE9E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BE9E00 second address: BE9E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB12CBAF1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF17D5 second address: BF1804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FB12CBDA253h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1804 second address: BF1810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FB12CBAF1A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1810 second address: BF1814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1814 second address: BF182D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1ABh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FB12CBAF1B2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1AC4 second address: BF1AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007FB12CBDA242h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FB12CBDA247h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1AFA second address: BF1B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1C5F second address: BF1C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA23Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1C72 second address: BF1C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF1C78 second address: BF1C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B99FFF second address: B9A003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A003 second address: B9A00D instructions: 0x00000000 rdtsc 0x00000002 je 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A0D9 second address: B9A0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B9A0DD second address: B9A0E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF291F second address: BF2937 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB12CBAF1AEh 0x00000008 jo 00007FB12CBAF1ACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB625 second address: BFB663 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB12CBDA236h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB12CBDA23Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FB12CBDA248h 0x0000001a push esi 0x0000001b pop esi 0x0000001c pushad 0x0000001d popad 0x0000001e jp 00007FB12CBDA236h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB663 second address: BFB66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB66B second address: BFB66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB66F second address: BFB68E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB68E second address: BFB694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFB694 second address: BFB698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF97C6 second address: BF97DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jl 00007FB12CBDA236h 0x0000000b jnp 00007FB12CBDA236h 0x00000011 popad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF97DD second address: BF97EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FB12CBAF1A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF97EE second address: BF97F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF97F2 second address: BF9806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB12CBAF1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FB12CBAF1AEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF9806 second address: BF980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF9B20 second address: BF9B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF9B24 second address: BF9B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB12CBDA23Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF9B36 second address: BF9B40 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB12CBAF1AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BF9E1F second address: BF9E33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFABA0 second address: BFABAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB12CBAF1A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFABAA second address: BFABAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFABAF second address: BFABC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1B3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: BFCE16 second address: BFCE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB12CBDA246h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C015AF second address: C015D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB12CBAF1B4h 0x0000000c je 00007FB12CBAF1A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C015D0 second address: C015E0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB12CBDA236h 0x00000008 jnp 00007FB12CBDA236h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C015E0 second address: C01621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B0h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FB12CBAF1C5h 0x00000017 jmp 00007FB12CBAF1B3h 0x0000001c jmp 00007FB12CBAF1ACh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C01621 second address: C0163F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA241h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FB12CBDA236h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C05BE2 second address: C05BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1B8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C05D83 second address: C05D8F instructions: 0x00000000 rdtsc 0x00000002 js 00007FB12CBDA23Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C05EC9 second address: C05ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C06188 second address: C0619D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB12CBDA23Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0619D second address: C061A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C061A1 second address: C061D4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB12CBDA245h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB12CBDA23Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0633F second address: C06353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1AFh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C06353 second address: C06370 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB12CBDA238h 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007FB12CBDA247h 0x00000010 jmp 00007FB12CBDA23Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C064B8 second address: C064C7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB12CBAF1A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C064C7 second address: C064EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA247h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C06619 second address: C0661D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0661D second address: C0665D instructions: 0x00000000 rdtsc 0x00000002 js 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jmp 00007FB12CBDA248h 0x00000019 jmp 00007FB12CBDA243h 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B4BF46 second address: B4BF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B4BF4A second address: B4BF63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB12CBDA241h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0F7EE second address: C0F7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B45181 second address: B451B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA247h 0x00000009 jmp 00007FB12CBDA23Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 jg 00007FB12CBDA236h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B451B5 second address: B451D6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB12CBAF1A6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FB12CBAF1A6h 0x00000014 jmp 00007FB12CBAF1ADh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0D9D8 second address: C0D9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0DE6D second address: C0DE97 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FB12CBAF1B2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB12CBAF1B0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0DE97 second address: C0DE9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0E53D second address: C0E542 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0E542 second address: C0E55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB12CBDA241h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0E55E second address: C0E562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0E562 second address: C0E580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA248h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0E848 second address: C0E84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0D538 second address: C0D53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0D53C second address: C0D551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBAF1ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C0D551 second address: C0D555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C16F30 second address: C16F35 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C16BFD second address: C16C0F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB12CBDA236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FB12CBDA236h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2892C second address: C2894E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB12CBAF1B7h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2894E second address: C2895E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2895E second address: C2897E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB12CBAF1B6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C28AB7 second address: C28AD5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB12CBDA243h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C28AD5 second address: C28ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C28ADB second address: C28AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FB12CBDA236h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C28AEE second address: C28AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2B214 second address: C2B23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FB12CBDA23Dh 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FB12CBDA23Fh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2B23B second address: C2B270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB12CBAF1ABh 0x00000008 jmp 00007FB12CBAF1B1h 0x0000000d jmp 00007FB12CBAF1B2h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2B270 second address: C2B276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2F9CB second address: C2F9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB12CBAF1A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2F9DC second address: C2F9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2F9E0 second address: C2F9E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2E561 second address: C2E577 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2E577 second address: C2E583 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB12CBAF1A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2E6E2 second address: C2E6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C2E6EB second address: C2E6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB12CBAF1A6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B50FAD second address: B50FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA23Bh 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jng 00007FB12CBDA238h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B50FC9 second address: B50FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B50FD1 second address: B50FD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C35E8E second address: C35E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C35E92 second address: C35EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB12CBDA23Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FB12CBDA249h 0x0000000f jmp 00007FB12CBDA243h 0x00000014 jmp 00007FB12CBDA249h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007FB12CBDA236h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C375F9 second address: C375FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C375FD second address: C37603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C37603 second address: C3760B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3760B second address: C3760F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3760F second address: C3761F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3761F second address: C37624 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3C06E second address: C3C073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B52A83 second address: B52A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: B52A8B second address: B52A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3BF1E second address: C3BF22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C3BF22 second address: C3BF26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4263A second address: C4265E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA249h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4265E second address: C4267A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4267A second address: C4267E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42806 second address: C4280C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42A7E second address: C42ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 jp 00007FB12CBDA23Ch 0x0000000d push edi 0x0000000e jmp 00007FB12CBDA23Bh 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edi 0x00000016 jmp 00007FB12CBDA247h 0x0000001b popad 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42ABC second address: C42AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB12CBAF1A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42C25 second address: C42C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42DD2 second address: C42DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C42DD8 second address: C42DF0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB12CBDA238h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB12CBDA23Ah 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C43B86 second address: C43B8B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C463C9 second address: C463DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB12CBDA236h 0x0000000a jmp 00007FB12CBDA23Bh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4A230 second address: C4A234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4A234 second address: C4A25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FB12CBDA241h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FB12CBDA23Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4A25C second address: C4A261 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C4A261 second address: C4A269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C49F89 second address: C49F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C55767 second address: C5576B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C5576B second address: C55777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FB12CBAF1A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C69235 second address: C69252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBDA23Ah 0x00000009 jng 00007FB12CBDA236h 0x0000000f popad 0x00000010 push ebx 0x00000011 jne 00007FB12CBDA236h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C6D235 second address: C6D23A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C7527A second address: C75285 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FB12CBDA236h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C771A1 second address: C771C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB12CBAF1B9h 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C771C3 second address: C771DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB12CBDA240h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C771DA second address: C771F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB12CBAF1B1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C771F5 second address: C771FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB12CBDA236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C6CF2F second address: C6CF35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	RDTSC instruction interceptor: First address: C6D0B2 second address: C6D0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c js 00007FB12CBDA236h 0x00000012 jc 00007FB12CBDA236h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b pushad 0x0000001c jmp 00007FB12CBDA23Bh 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 jg 00007FB12CBDA236h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Special instruction interceptor: First address: 9DDD20 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Special instruction interceptor: First address: BACE25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Special instruction interceptor: First address: 9DDC6A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Special instruction interceptor: First address: C183B4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_00B65240 rdtsc

0_2_00B65240

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe TID: 7736

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_00BBDEF2 GetSystemInfo,VirtualAlloc,

0_2_00BBDEF2

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: uw7vXaPNPF.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: uw7vXaPNPF.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: uw7vXaPNPF.exe, 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the drive

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	File opened: NTICE
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	File opened: SICE
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_00B65240 rdtsc

0_2_00B65240

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_009DB984 LdrInitializeThunk,

0_2_009DB984

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: uw7vXaPNPF.exe, uw7vXaPNPF.exe, 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Code function: 0_2_00BB44ED GetSystemTime,GetFileTime,

0_2_00BB44ED

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\uw7vXaPNPF.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Process Injection	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Bypass User Account Control	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uw7vXaPNPF.exe	61%	ReversingLabs	Win32.Spyware.Lummastealer
uw7vXaPNPF.exe	61%	Virustotal		Browse
uw7vXaPNPF.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579678
Start date and time:	2024-12-23 07:25:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uw7vXaPNPF.exe renamed because original name is a hash value
Original Sample Name:	0f57c7a8b420e451c9f4dfe710d0dcd3.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
Report size getting too big, too many NtProtectVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	HOEcO4nqCT.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	D7M4c24p9T.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.63
	clip64.dll	Get hash	malicious	Amadey	Browse	13.107.246.63
	https://staging.effimate.toyo.ai-powered-services.com/	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	13.107.246.63
	1734732185f25c13093a41a2402fb93b0e0049d55263e81e9d0e56f9c3736f6444c26eed34495.dat-decoded.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	13.107.246.63

Process:	C:\Users\user\Desktop\uw7vXaPNPF.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4627969913065115
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uw7vXaPNPF.exe
File size:	2'814'464 bytes
MD5:	0f57c7a8b420e451c9f4dfe710d0dcd3
SHA1:	ce586063030b771b50e0527f02ab8c11e75901b5
SHA256:	bc3b18240bfa7834a398945b207b76c4445be32e590ef8459b41e4423f737ad3
SHA512:	b22c22d5c7221611d6d7bd733e80e7f6105c3d161903a4dfe91ec460b7b0d26131ed3a4140a1f104382e3a721a41b7c490ff08cd3e6b62b9f1663752b897b3f0
SSDEEP:	49152:2Dwu9APnRSsufnJqBXd9e58stDE0gVxJQUWq316qWrVya4:2DRAPnMsufnJgX0WVUUWqEXrU
TLSH:	34D53BA2F50971CFE48E17789527CD8A9A6D03B91B1508C3AD6C75B9FD73CC212BAC24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....R%+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB12D0D07DAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x544	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x4000	4d1f9b87774d7072304da3a0ce1ea2de	False	0.3353271484375	data	5.063817710552147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x544	0x600	66f1faa8706f0a4070d24696bcded2f0	False	0.408203125	data	4.460395930973943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yyhljryf	0xa000	0x2a8000	0x2a6400	80986f9ce8bb4734c4cc56a9cfd5df3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ddvyecmu	0x2b2000	0x2000	0x400	7fe3a68ff142f15581ac7c247eb098eb	False	0.8115234375	data	6.3334895728613185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b4000	0x4000	0x2200	aa0aab554de374a9857e528b3f7a272d	False	0.06973805147058823	DOS executable (COM)	0.8895844021079824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60a0	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:26:42.352571964 CET	1.1.1.1	192.168.2.9	0x21ba	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 07:26:42.352571964 CET	1.1.1.1	192.168.2.9	0x21ba	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	01:26:45
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\uw7vXaPNPF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uw7vXaPNPF.exe"
Imagebase:	0x9d0000
File size:	2'814'464 bytes
MD5 hash:	0F57C7A8B420E451C9F4DFE710D0DCD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	4%
Signature Coverage:	4.6%
Total number of Nodes:	372
Total number of Limit Nodes:	24

Executed Functions

Function 00BBDEF2 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-118F5FEC), ref: 00BBDEFE
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00BBDF5F

Memory Dump Source

Source File: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: b91a8284267b391d532c5e6de92c095888e5744c595b988e4cd84b3c655521d2
Instruction ID: e445233ea49a053d015bae6155593af1ec85439bc47d96d166bd0d2227fffc62
Opcode Fuzzy Hash: b91a8284267b391d532c5e6de92c095888e5744c595b988e4cd84b3c655521d2
Instruction Fuzzy Hash: 114117B1900206AFD725DF62CC45BE6BBECFB18741F0041A6AA07D9892E7B1D5D48BA1

Function 050915D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 050918C8

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 57ee0b9068b6a57968fec0fe2bc7e7bf973758142dccf37904c524cc81e6e113
Instruction ID: bc9d8b8a9ec504feed5ae64d87f36d84c0fb76b7b9bf33cef33294f238579654
Opcode Fuzzy Hash: 57ee0b9068b6a57968fec0fe2bc7e7bf973758142dccf37904c524cc81e6e113
Instruction Fuzzy Hash: 36C16A71E0025A9FDF14CFA8E9857EEBBF2FF44300F048129E855A7288D7748881EB81

Function 00B65240 Relevance: 1.6, APIs: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 018297fb250e8842ac7ac6fdb60d23e0dec80d9ca4b5c2cd27c6bc01d4826bbc
Instruction ID: f7314de88bb948a555675c9d7e3361ff05a87b183e6910d79b5e028803b6a99b
Opcode Fuzzy Hash: 018297fb250e8842ac7ac6fdb60d23e0dec80d9ca4b5c2cd27c6bc01d4826bbc
Instruction Fuzzy Hash: 1801F7F244CB55ADD7309F648DA46BD37E9EB92330F3006A6E84296582E2E90D395624

Function 009DB984 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036c4a85514a4874fbc3635589d0c8ad827a05141385f6896ae7eb2b3fd40b5c
Instruction ID: 1934f0292f072a3ef9292617b52cd682e3b0ef98c277e207cf1f887450e3bedf
Opcode Fuzzy Hash: 036c4a85514a4874fbc3635589d0c8ad827a05141385f6896ae7eb2b3fd40b5c
Instruction Fuzzy Hash: C6E08C3108E7C2DECB474B7848661507F709E1B21C32E68DBD5C9DB263C2192416C703

Function 00BB1A73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00BB1B84
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00BB1B98

Strings

.exe, xrefs: 00BB1ADF
1002, xrefs: 00BB1B4E
.dll, xrefs: 00BB1ABB

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: aae0d043cac43e95627fcb61ff2f66e7bbda99f0c1c1b3e954ec2c7b006fa87c
Instruction ID: 9ec6cd15f8d67600a6087c7e1f33df8599192af12137d6dcf7c64ff19ebd4413
Opcode Fuzzy Hash: aae0d043cac43e95627fcb61ff2f66e7bbda99f0c1c1b3e954ec2c7b006fa87c
Instruction Fuzzy Hash: 3A319F31900109EFCF25AF58D964AFD7BF6FF04350F5088A5F80696121EBB09DA1DBA1

Function 00BBE91E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(?,?,6578652E,?,00000001,00000000,?), ref: 00BBE93A

Strings

.exe, xrefs: 00BBEA84
.exe, xrefs: 00BBEA49, 00BBEA8F, 00BBEA5A, 00BBEA6D

Memory Dump Source

Source File: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: HandleModule
String ID: .exe$.exe
API String ID: 4139908857-1392631246
Opcode ID: 670a41efa05adcab5703c68a4ebde41a95c685154da75382f04da7947203d8bd
Instruction ID: ed7fe09385b73108a6439c243230426b10cadbd4a45269e8dbb1faa5c39bb054
Opcode Fuzzy Hash: 670a41efa05adcab5703c68a4ebde41a95c685154da75382f04da7947203d8bd
Instruction Fuzzy Hash: 58416771900206EFDB20CF64D944BFA7BF5FB40310F148095E962AA1A2D3B1EC94DB91

Function 00BB1F79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00BB1F0B,?,00000000,00000000), ref: 00BB2036
GetModuleHandleA.KERNEL32(00000000,?,?,?,00BB1F0B,?,00000000,00000000), ref: 00BB2044

Strings

.dll, xrefs: 00BB1FAC

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 7bebfbefb4de0eb542495c298ee61536cec2f811d79a85d2f6816fdb0a61f2e5
Instruction ID: 5523154943e7095f8b17782caf3e5f1da4f1c90a81d9f15d99e429d61d7ce094
Opcode Fuzzy Hash: 7bebfbefb4de0eb542495c298ee61536cec2f811d79a85d2f6816fdb0a61f2e5
Instruction Fuzzy Hash: EB115E31600A09EFDB36AF24D8587F976F1FF00345F8081A2A502444E1C7F599D4DB81

Function 00BB48D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(011B0174,-118F5FEC), ref: 00BB494C
GetFileAttributesA.KERNEL32(00000000,-118F5FEC), ref: 00BB495A

Strings

@, xrefs: 00BB48FF

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: e77911c8ef6abe7eee60ddf0ef3399e429fe7828b7fc7c44e8913ce11c866105
Instruction ID: 19e362f8f96e519484ea5cb3df1c13aeec4361936d808aece2f1ab8f69f9d97c
Opcode Fuzzy Hash: e77911c8ef6abe7eee60ddf0ef3399e429fe7828b7fc7c44e8913ce11c866105
Instruction Fuzzy Hash: A70119B0A05244FFEB21AF58D9497FE7EF0FF81345F2080E5E54269096D7F09A91E684

Function 00B710CF Relevance: 4.6, APIs: 3, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00B72443
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00B7246A
GetNativeSystemInfo.KERNELBASE(?), ref: 00B724C1

Memory Dump Source

Source File: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 44960f502204d339208d231f3606e94e7625f5fcc76e9d6d39f0e70666d70049
Instruction ID: 7ce55088ef6ad0a6a96d7b7b0126d944d06e989c69cb8eddfeecbbc1f49fdf30
Opcode Fuzzy Hash: 44960f502204d339208d231f3606e94e7625f5fcc76e9d6d39f0e70666d70049
Instruction Fuzzy Hash: 9F31067250414EEEEF11DF60C888BEE3BE4EF04314F440466EA5691950DBBA8DA4DF58

Function 00BB0953 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00BB09B5

Strings

\\?\, xrefs: 00BB0A10

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: fea2703f255e87a1b7f925d83f1e5c9b2a001a0bd82c99c9a24f45c6d76526bf
Instruction ID: a8779fd819b1fe2cec69f1f0cc31b648a809389f1b45c1dba5485bcf845c9099
Opcode Fuzzy Hash: fea2703f255e87a1b7f925d83f1e5c9b2a001a0bd82c99c9a24f45c6d76526bf
Instruction Fuzzy Hash: F7310735A10609FFDF21EF94D949BFEB6B5FF48704F000590B902A54A0D7B29AA1EF50

Function 00BB2062 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00BB20C6

Strings

.dll, xrefs: 00BB2083

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 0fcc3cbdb38978632201ce1d93dbab6613c53efec75f2041dd018562cce81422
Instruction ID: 432ef37d23be56f3e1f4c30f818d26c3bf72e3d9461a0d743340c027fe3638c4
Opcode Fuzzy Hash: 0fcc3cbdb38978632201ce1d93dbab6613c53efec75f2041dd018562cce81422
Instruction Fuzzy Hash: A3F06D31104205ABEB10BF64D889AFE3BE1FF08350F508491FE0585152C7B1C490DB51

Function 00BB4AEF Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(011B0174,?,?,-118F5FEC,?,?,?,-118F5FEC,?), ref: 00BB4BA1

Part of subcall function 00BB4AA1: IsBadWritePtr.KERNEL32(?,00000004), ref: 00BB4AAF

CreateFileA.KERNEL32(?,?,?,-118F5FEC,?,?,?,-118F5FEC,?), ref: 00BB4BC1

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: f5aff1c33e7af65ab9f02f77fa1a6edd4fdf035dce527a85d517eb574ac514a5
Instruction ID: 6a27ff41da20e7d3faae4c8ea696f7a9730ff5cdd28b5d057385c3833e6f4469
Opcode Fuzzy Hash: f5aff1c33e7af65ab9f02f77fa1a6edd4fdf035dce527a85d517eb574ac514a5
Instruction Fuzzy Hash: 6311D671500109FBDF22AFA4DA49BFE3AB2BF04344F008195BA06654A2C7B5C9A1EB91

Function 00BB445B Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

GetCurrentProcess.KERNEL32(-118F5FEC), ref: 00BB4468
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BB44CE

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: d8ddbd7466f3b3aeebb6f73527b76fdae4c876fb0815211b8f8687757a5a5b77
Instruction ID: 211e9990e270716ebb9bb4796427e9078977989fd2b2a560653e36d719ddd767
Opcode Fuzzy Hash: d8ddbd7466f3b3aeebb6f73527b76fdae4c876fb0815211b8f8687757a5a5b77
Instruction Fuzzy Hash: F2014B3210000AEB8F22AFA8ED08DFE3BF5FF88350B008151FA05A0115CBB5C472EB61

Function 050915C4 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 050918C8

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: c70627fb364954980786667fc4f302b8a23d7b1a23e7921dab33d2f3f44e7632
Instruction ID: 50e808a67645ca2cb48a05fa2bd9f907c986b3d133293b9969aed6d2cee10906
Opcode Fuzzy Hash: c70627fb364954980786667fc4f302b8a23d7b1a23e7921dab33d2f3f44e7632
Instruction Fuzzy Hash: D0C16A75E0025A9FDF14CFA8E9857EEBBF2FB44300F148129E855E7288D7748881EB81

Function 00B64F71 Relevance: 1.7, APIs: 1, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272c78878d37333ebc8ad719aece0b3759eb0756767429873c8a8f40636568c1
Instruction ID: dc20669ef2f171f778660f649037e91a6dec80d78fed26d8ff3437c1aa3011bc
Opcode Fuzzy Hash: 272c78878d37333ebc8ad719aece0b3759eb0756767429873c8a8f40636568c1
Instruction Fuzzy Hash: 0C4126B314C7527EE722CA609DA1BFF7BACDB82730F31449AF442DA482C29C4C659275

Function 00B6506B Relevance: 1.6, APIs: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,F53787D4), ref: 00B650C1

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 819e6a405e4b6c08142821ba5a8319b688ca1d896ac556e503c7bf82240be18e
Instruction ID: f9f46cba492fb1dff568e6e5588e935a31d0b077ef40dd2c19a028432574aee6
Opcode Fuzzy Hash: 819e6a405e4b6c08142821ba5a8319b688ca1d896ac556e503c7bf82240be18e
Instruction Fuzzy Hash: 043113B614C3517EE322CF609D91BFB7BACEB83730F31849AF442DA442D2694C259671

Function 00B65050 Relevance: 1.6, APIs: 1, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,F53787D4), ref: 00B650C1

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8d23da556b0f1c9b757e73733b3c7dfe52491c84dbca01566b9836024a980383
Instruction ID: 6c6a4f12b70d0f7aac48aeac71ce2e963a091b34c5e2c845108a83e8c00d3d86
Opcode Fuzzy Hash: 8d23da556b0f1c9b757e73733b3c7dfe52491c84dbca01566b9836024a980383
Instruction Fuzzy Hash: D23147B700C6917EE321CA606D60AFB7BBCDAC3730F3544DAF842D6442D2990C259371

Function 00B650AD Relevance: 1.6, APIs: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,F53787D4), ref: 00B650C1

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 29bd4d71b082a7806d4a949ddff9aeeadba4d339d9ae0547d0a4baeafea2e140
Instruction ID: 47325821dbac3cfb7bcdd78357e3e10f84c6ae8dd079b6e256e18fe8c069ad41
Opcode Fuzzy Hash: 29bd4d71b082a7806d4a949ddff9aeeadba4d339d9ae0547d0a4baeafea2e140
Instruction Fuzzy Hash: 912192F710D6517EF221DA546E60BFB7BACDAC3730F3188ABF442D6542D2590C559231

Function 00B64E14 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 75baaf97949f2ad463ea3a28c12749e89726fd2b2ff3fe14ef6ea0a4b1a4e80b
Instruction ID: 3733175d6d308d7d2e6b9dfa0ab00a49c9447b8e8c130e632d2f8498932ae6ef
Opcode Fuzzy Hash: 75baaf97949f2ad463ea3a28c12749e89726fd2b2ff3fe14ef6ea0a4b1a4e80b
Instruction Fuzzy Hash: 34315BB614C642AFC3069F54D9916EABBE8FF86330F2444D6E585CB143E3A90806C731

Function 00BB2ADA Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00BB2B8F

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9f48fd3551a0a137fcb0d4c963c3a32d0b45582ae48ac6f280b40be7712421d5
Instruction ID: a29593482cacb36990a261d681f8a87ab74007c92d8682f7e8aa0edaae325fa5
Opcode Fuzzy Hash: 9f48fd3551a0a137fcb0d4c963c3a32d0b45582ae48ac6f280b40be7712421d5
Instruction Fuzzy Hash: 65316B71900208FFDB209F65DD45FEEBBF8EB04724F2082A9F605AA191C7B19A41CB50

Function 00B61988 Relevance: 1.6, APIs: 1, Instructions: 102libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00B61988

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c0ef90b13f849a7e1c0fd955d64892db41727741a512ee00a87c04a032cfbae2
Instruction ID: 5e580085c9459dd9a0301198dc9a7c93040cfb602ef8f0b8766270da5ffb5c87
Opcode Fuzzy Hash: c0ef90b13f849a7e1c0fd955d64892db41727741a512ee00a87c04a032cfbae2
Instruction Fuzzy Hash: 1A31EBB250D700AFE301AF19DC85BBEBBE4EF88711F16482DE6C8C2600D63599548B97

Function 00B64EBA Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000003), ref: 00B64F26

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a557e747b3199faf3770d7870c29f6e518e9209a72735c8cbb3b6d06b1a1e2b3
Instruction ID: 7e1fbdfc3aecb083f0bb13b7d87c4df1e91f7cbffc0bc392d0b50dc77af361f7
Opcode Fuzzy Hash: a557e747b3199faf3770d7870c29f6e518e9209a72735c8cbb3b6d06b1a1e2b3
Instruction Fuzzy Hash: 58219EB318CA42AED3058F609D51AF97BE8FB82730F3004D6E445C7483D3590D069730

Function 00B61AD0 Relevance: 1.6, APIs: 1, Instructions: 93libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00B61AD0

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b5ae000d1e0d257d6025f0e2261aaadf1b85945aa797fa263ca8615fad5ca10c
Instruction ID: 7740a495037fa728221cf3632176db39d19683baedfdcaf7b6e3f416142da39e
Opcode Fuzzy Hash: b5ae000d1e0d257d6025f0e2261aaadf1b85945aa797fa263ca8615fad5ca10c
Instruction Fuzzy Hash: CD3178B240C300AFE742AF18DC816BAFBE5EF54320F16482DE6D883610EB3598448B97

Function 00BB22F6 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00BB2378

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4537a339ed0ee8d406e91b50a5f33d2e9127fa239bcd56ed07aac9da488ffe36
Instruction ID: a435b46dbf4feb68fe05fba87b7b5bf48a3b8449aef565249c8e6351894e7b9b
Opcode Fuzzy Hash: 4537a339ed0ee8d406e91b50a5f33d2e9127fa239bcd56ed07aac9da488ffe36
Instruction Fuzzy Hash: CD319371A40204BFEB209F64EC45FE9B7F8EB04B24F2082A5F615EA1D1C3F5A592CB54

Function 00B64E47 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000003), ref: 00B64F26

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: affc6a9b353c17222409abb322e7eaf0b195aebaad7cb8b0f99b04bcc98557b2
Instruction ID: 4f0cea4895285d0f758059b82b3d7abb4f52ac3034c8810d161edf4367f29054
Opcode Fuzzy Hash: affc6a9b353c17222409abb322e7eaf0b195aebaad7cb8b0f99b04bcc98557b2
Instruction Fuzzy Hash: 86216AB614C642AEC7068F54D9904EABBF8FF8633073444EAE081C7143E3A90916D771

Function 00B64E2E Relevance: 1.6, APIs: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000003), ref: 00B64F26

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 102be26d508e04e1a4b44e415b27215be632d27ff72a50523d33dd8bb7153c7c
Instruction ID: 687ecf331e8988e417686a47fce9f9e3179a7d5df73976e135079fb246623358
Opcode Fuzzy Hash: 102be26d508e04e1a4b44e415b27215be632d27ff72a50523d33dd8bb7153c7c
Instruction Fuzzy Hash: D0216BB618CA42AFC7068F54D9904AABBF8FB8673073444EAE085C7547D3A90D16D771

Function 00B64E7B Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6f3a43661638f6a594e1f39431d48f1ae904614e940df604351f72586b4a79e5
Instruction ID: 889bdf7da069f6828411988b8759ab6f01e190906dfcc85cf2255cda40007577
Opcode Fuzzy Hash: 6f3a43661638f6a594e1f39431d48f1ae904614e940df604351f72586b4a79e5
Instruction Fuzzy Hash: 9C116AA614C6829ED3029F649D514E9BBE8FA47330B3404AAE4C5CB543D3A9490BD731

Function 00B64E98 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000003), ref: 00B64F26

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7fc7ef47ace96ce331dbc2f797477313c312254604ac46aff305fe18d20cef3b
Instruction ID: 49e43694929c6bcea45a73447d3b5125f8e541e2e300921e5dd256025f6c5070
Opcode Fuzzy Hash: 7fc7ef47ace96ce331dbc2f797477313c312254604ac46aff305fe18d20cef3b
Instruction Fuzzy Hash: 9B1157B644C6829ED3029F649DA14E9BBE8EE96330724059AE485CB147D369091AC731

Function 00BBE66B Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00BBE718

Memory Dump Source

Source File: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: e7c2d9ae2d31388dcc825faad5bb64531717335b8cdc0c41ba043f0617cb49af
Instruction ID: 85948d0e6049ed157da00b21b13161b3008a36b55e02a4de62730501fbcc1f2c
Opcode Fuzzy Hash: e7c2d9ae2d31388dcc825faad5bb64531717335b8cdc0c41ba043f0617cb49af
Instruction Fuzzy Hash: 76119072A012299FEF319A168C48BFAB7FCEF14754F1441E5E825A2090DBF4DD808AB1

Function 05090D41 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05090DCD

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5f736e73b0bec2fca6b11cc9dbcb2e1b139e2558dfc0a67a2b970a5d1f7dd1ff
Instruction ID: eaad15742517ee8db11b7ac951325ca56b9fe673e436a9e111dade7ab235930d
Opcode Fuzzy Hash: 5f736e73b0bec2fca6b11cc9dbcb2e1b139e2558dfc0a67a2b970a5d1f7dd1ff
Instruction Fuzzy Hash: 632138B6D016189FDB54CF99E485BDEFBF0FF88310F14826AD808AB248D7349545CBA4

Function 05090D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05090DCD

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 142c52c558f4a5ce270c90f0e4f42d3281cb9a333b26a78435f22a194cb440ed
Instruction ID: 2dabdab11569f0d396991cdce56927208897ff8390665dff3f62f6c79918401b
Opcode Fuzzy Hash: 142c52c558f4a5ce270c90f0e4f42d3281cb9a333b26a78435f22a194cb440ed
Instruction Fuzzy Hash: 482135B6C016189FCB54CF99D884BDEFBF4FF88310F14815AD808AB208D734A544CBA4

Function 05091509 Relevance: 1.6, APIs: 1, Instructions: 56serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05091580

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 7eec8b91aa716affc5abe75ca6e3c023e3b63bdfe6a471b14cf06425db5dbf6c
Instruction ID: dbe5ad3dd59757809950c0567996eb23b3cad7905f17389344b059e818e34beb
Opcode Fuzzy Hash: 7eec8b91aa716affc5abe75ca6e3c023e3b63bdfe6a471b14cf06425db5dbf6c
Instruction Fuzzy Hash: FC2114B2900249DFDB10CF9AD584BDEFBF4FB48320F10846AE559A7240D378A645CFA5

Function 05091510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05091580

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: f50c35db56c8d842529a22286abd0cc799c95a1e1899736ce5f4b21c7cb234ff
Instruction ID: db611c0f8b745e6127cad12941d9f97b7cf280904324173a17fbc8f4c80c8e24
Opcode Fuzzy Hash: f50c35db56c8d842529a22286abd0cc799c95a1e1899736ce5f4b21c7cb234ff
Instruction Fuzzy Hash: 5011E4B6900249DFDB10CF9AD584BDEFBF4FB48320F14806AE559A7250D378A644CFA5

Function 00BB5627 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-118F5FEC), ref: 00BB56AE

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: f317c937cb4c57623a82372120d10da4b8e4be1676643e7bdb4a98c445efa434
Instruction ID: 13d0ab19b0db8a2ca0b953127a38e866c53ff08488e4dcc567842b5f2b5fbdcb
Opcode Fuzzy Hash: f317c937cb4c57623a82372120d10da4b8e4be1676643e7bdb4a98c445efa434
Instruction Fuzzy Hash: E111A83210064AFFCF22AFA4DD09EFE3BB6AF58340B404591FA0255021D7B6C471EB62

Function 00BB540F Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 7621238276d1ea988aa57609972edc3ed621f91c952dd7ce4f5585176e465cdc
Instruction ID: f4022271dc83958994c92ec199f827172a0d8cdef014298a1ce20811d0483f42
Opcode Fuzzy Hash: 7621238276d1ea988aa57609972edc3ed621f91c952dd7ce4f5585176e465cdc
Instruction Fuzzy Hash: A6113C7150054AEBCF22AFA4C909BFE3BE5EF44341F008490F90649265C7F5C5A2EB52

Function 05091301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05091367

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: bff5bf5fb11968f99be7b34e96e904b9ed33bf15061a19e4ab8ca08e5d674ac7
Instruction ID: f8a6a3120ca2a93c8c7f5489cfba3c7e48506a8db18d666aa5a1795502b49520
Opcode Fuzzy Hash: bff5bf5fb11968f99be7b34e96e904b9ed33bf15061a19e4ab8ca08e5d674ac7
Instruction Fuzzy Hash: 531166B2900249CFDB20CF9AD585BEEFBF4EF48320F14846AD459A3240D778A544CFA1

Function 00B652B9 Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 33143a9b98e4837b99e69e4bc82c14b4ca31e2775067b3d4423dede27da1e92e
Instruction ID: 40f9214c87579ef3cfe7387d2534f793f7a6e59bd605bd7e687e67565e75afe5
Opcode Fuzzy Hash: 33143a9b98e4837b99e69e4bc82c14b4ca31e2775067b3d4423dede27da1e92e
Instruction Fuzzy Hash: 75019EF250C7458EE710CF205DB41BE3BB8DA92330F7005DAE842C7143D3A80D6A9728

Function 05091308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05091367

Memory Dump Source

Source File: 00000000.00000002.1501484139.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_uw7vXaPNPF.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 165f54f62216c1f9c804093152bb81a152ba8429e5fc732394425fb937d10a0d
Instruction ID: 7e62249328629c7c012e34d4accdc2e547d3123023963d63870a3a128a2f1b73
Opcode Fuzzy Hash: 165f54f62216c1f9c804093152bb81a152ba8429e5fc732394425fb937d10a0d
Instruction Fuzzy Hash: 911133B2900249CFDB20CF9AD545BDEFBF8EB48320F24846AD518A3640D778A944CFA5

Function 00B65254 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e94cb2e6520a0b761ed13fcb35f1ad0fc7d55d7ec585187b191a82e462670251
Instruction ID: 236d99d6dc220ef52ab4d0d8e83d56c043432769adddc9b603f43546f078cf52
Opcode Fuzzy Hash: e94cb2e6520a0b761ed13fcb35f1ad0fc7d55d7ec585187b191a82e462670251
Instruction Fuzzy Hash: D5F028F2448A05ADD7208F5099A15BE7BEDE692330F3009A6E802D6902E3E90D3E6664

Function 00B65278 Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8712e97f19ec8d526fe8036cc35ce637ebdae5fe493202243a77d4d95aeaf875
Instruction ID: 879afa865e2ea4cc0da3fe99237765c2a154aedca9da021c8bcce2e57f8c5f6d
Opcode Fuzzy Hash: 8712e97f19ec8d526fe8036cc35ce637ebdae5fe493202243a77d4d95aeaf875
Instruction Fuzzy Hash: 7CF081F240C7059DE720CF109DE057E37A9DA81370F70055AE842C2442D3B90D395618

Function 00BB4CF3 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-118F5FEC,?,?,00BB2A22,?,?,00000400,?,00000000,?,00000000), ref: 00BB4D5F

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: bd8f69f3c9aabf8045ef0e91249fafabc47dd5034fe1bf65a7241b9ac43949c3
Instruction ID: 8bd9c5fd53b10c3556c355194406f8a98d6bead5e503c4d4060858a6f2605b19
Opcode Fuzzy Hash: bd8f69f3c9aabf8045ef0e91249fafabc47dd5034fe1bf65a7241b9ac43949c3
Instruction Fuzzy Hash: 39F0C93210050AFBCF12AFA8D919EFE3FB6FF45350B0085A1F61559161C7B2C862EBA1

Function 00B652A2 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 36239037f02f40e9dc58c5d85077e2f6444d767dd07a3c4556a06bff37f4eb05
Instruction ID: 0ac4ee7bf36e73b3a68c9e5651b4e49d3c325f37dc0d8cff707fa6dd00485445
Opcode Fuzzy Hash: 36239037f02f40e9dc58c5d85077e2f6444d767dd07a3c4556a06bff37f4eb05
Instruction Fuzzy Hash: C0E0E5F24486155CE710DF149DA0ABE37ADE6D1330F304455E846D6441E2A80D390628

Function 00B652D5 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 35664c4d3293590a42bf9f944d65df2f1e4a5ceed02317414ae9415b369ed868
Instruction ID: f6871e538590f7f8ff06f22452708293c2c6332ffafe6f6cdc8914caafb0231b
Opcode Fuzzy Hash: 35664c4d3293590a42bf9f944d65df2f1e4a5ceed02317414ae9415b369ed868
Instruction Fuzzy Hash: 57F0E5B290C7864ED720DF3488A062D3BA4CA927A0F2009EAD481CB441C2A50C2B8B15

Function 00B652C2 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,D4DF2F4F), ref: 00B652F8

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 127e210bb562ae035dd65ccd928e17ac6c36f5ce7f1a72548071c10c725089b8
Instruction ID: 1b766d292c548c4b6ab41ef7cad1b58458c1d11b4adfa938815ffb87d2ef847d
Opcode Fuzzy Hash: 127e210bb562ae035dd65ccd928e17ac6c36f5ce7f1a72548071c10c725089b8
Instruction Fuzzy Hash: F5E092B25486564EE7109F3098A126D7BB0EB92330F3044AAD442D6502C2E9496A4714

Function 00B6F6F5 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00B729FE

Memory Dump Source

Source File: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 467acaf560245e2b44a54e1f84f31b10f74c6ce1543672f707b23b5587482dde
Instruction ID: be88b18a2a0856655b65dac43fdc06ac1f61031b492f8c05a543e7f994790820
Opcode Fuzzy Hash: 467acaf560245e2b44a54e1f84f31b10f74c6ce1543672f707b23b5587482dde
Instruction Fuzzy Hash: C4D017B000C200DFC7012F58C88853DFBE4FF19300F218D5DDAE992210D3718460AB13

Function 009DE8EF Relevance: 1.3, APIs: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 009DEEC1

Memory Dump Source

Source File: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4ccb417048a209921072686ac5f7a1d70519b0c158f8f33f2c50e8405f1e17a
Instruction ID: dff0b7e53f1de13657a2be6c0308044114d06ab614dcbc253eb530bad0ebf477
Opcode Fuzzy Hash: d4ccb417048a209921072686ac5f7a1d70519b0c158f8f33f2c50e8405f1e17a
Instruction Fuzzy Hash: C2017CB211C610ABD300BF29DC85ABBBBE4EF44310F06492EE5C5C3600E63598408797

Function 00BB0571 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00BB05D5

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 604b8b0114fab6c8765e5f507d7a2f67b78c19eddcdac4c0ca6c2f47e3ca03f3
Instruction ID: f693cd140fa3b514e39b192ff260f02371da5d78dd9d4730ec94b35f55ea1276
Opcode Fuzzy Hash: 604b8b0114fab6c8765e5f507d7a2f67b78c19eddcdac4c0ca6c2f47e3ca03f3
Instruction Fuzzy Hash: 7B01E835A10109BFCF21AFA5DC45DEFBBB6FF54741F0011A1A805A4460E772D661DFA0

Function 009DED09 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 009DEEC1

Memory Dump Source

Source File: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e259facbac087f4b4033cd3646891b111eacf0c61d332ac6ee3cf2a0bfde4a9
Instruction ID: 7a5cfe48678dbcd2b4a76f16529dbf8e51680c0925d0d319c1bb7af0e392b3cc
Opcode Fuzzy Hash: 2e259facbac087f4b4033cd3646891b111eacf0c61d332ac6ee3cf2a0bfde4a9
Instruction Fuzzy Hash: 9BF03CB251C6149FD704BF29DC866BAB7E4EF45300F0A482ED5C5C7740E635A8408B97

Function 00BBE295 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00BBE291,?,?,00BBDF97,?,?,00BBDF97,?,?,00BBDF97), ref: 00BBE2B5

Memory Dump Source

Source File: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7f901a3160614ad900eab177a2fa261de006cffc1473325c7c162a8e95f7b90c
Instruction ID: 67e6ca54ae0d493d10c47244199d0ffc552dc093e95ddf94ddc413ec92ea0e2d
Opcode Fuzzy Hash: 7f901a3160614ad900eab177a2fa261de006cffc1473325c7c162a8e95f7b90c
Instruction Fuzzy Hash: BFF081B1904205EFDB25CF55CD09BE9BFE4FF54751F118065E44A9B5A1D3B198C0CBA0

Function 00BB30F4 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

CloseHandle.KERNELBASE(00BB2AB7,-118F5FEC,?,?,00BB2AB7,?), ref: 00BB3132

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: 41cabbfdd84471361feaf134d90078057186a6156e2919c412f875a58323a191
Instruction ID: b8045fe03af2ebeb0d0eb60e5a023c20295106132f406892f67caf5227608ec0
Opcode Fuzzy Hash: 41cabbfdd84471361feaf134d90078057186a6156e2919c412f875a58323a191
Instruction Fuzzy Hash: 6DE04F76604106B7CA10BB7DDC0ADFF2BECAF94B90B0081A1F106A5041CEE4C292D6A1

Function 00BB21B9 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00BB023F,?,?), ref: 00BB21BF

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 282ad15609651213df9d8423f0951060b89e5c9ab1d0f4863865477b24605be2
Instruction ID: 702362d17833af57cd83f9d2cebab70538b3f88664ccf2fb2478553c589ff141
Opcode Fuzzy Hash: 282ad15609651213df9d8423f0951060b89e5c9ab1d0f4863865477b24605be2
Instruction Fuzzy Hash: 1AB09B3140010977CF01BF55DC0584DBF65BF15755740C110B51A541718B71D560DBD0

Non-executed Functions

Function 00BB44ED Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

GetSystemTime.KERNEL32(?,-118F5FEC), ref: 00BB4522
GetFileTime.KERNEL32(?,?,?,?,-118F5FEC), ref: 00BB4565

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: 9ea96d4d38777bf1eff197894388ca0c561b92ba87889fee1960f9708d17985a
Instruction ID: 260a32e9f928e0c535c3c78a50e6db712bbb90505e30d3b9b7bbb76b4a0f6a22
Opcode Fuzzy Hash: 9ea96d4d38777bf1eff197894388ca0c561b92ba87889fee1960f9708d17985a
Instruction Fuzzy Hash: 8E012132100545FBCB21AF19D80CDFE3FB5FF96310B004161F40545462CBB2C4A1D691

Function 00BB53AB Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00BB53F2

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 9b7cfadff441e64f89d115d4595761480cf441fbcbeee6cf8da0b29d0407ec13
Instruction ID: 415786b8a4fbcfe0cfdd5bed3413c92805eb9ef76ee7fbfa52042f9706347cf5
Opcode Fuzzy Hash: 9b7cfadff441e64f89d115d4595761480cf441fbcbeee6cf8da0b29d0407ec13
Instruction Fuzzy Hash: 0DF0583260120AFFCF11CF94C944A9C7BF1FF18388B008465F91696250C7B59AA0EF45

Function 009DDDA4 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

NTDL, xrefs: 009DDF87

Memory Dump Source

Source File: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 67ce74282b56a5d5623da822fb5b93aad196232f704395b5c6ccc9a1ee3b0f9e
Instruction ID: c65d63804ff4bab0fcc8afeecb0f1a43f63b957f69749e91baef4e031369f32d
Opcode Fuzzy Hash: 67ce74282b56a5d5623da822fb5b93aad196232f704395b5c6ccc9a1ee3b0f9e
Instruction Fuzzy Hash: 8771DF7668931E8BCB11DF24C4401DF77A5EB96320F24C52BC8828BB41D3B69D11DF99

Function 00B61EDF Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

SR*n, xrefs: 00B62052

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID:
String ID: SR*n
API String ID: 0-1386546681
Opcode ID: 062d48fec95f91291ba162d7ede3aa2a077d8659e128dd60771bdb04e77ea6f1
Instruction ID: d48b1f663bd3425dbb711e45877c4f1ef1fe13bdbdf0b4f01ad12ab13bcc9699
Opcode Fuzzy Hash: 062d48fec95f91291ba162d7ede3aa2a077d8659e128dd60771bdb04e77ea6f1
Instruction Fuzzy Hash: 4541D9B660C300AFE701AE5DDD8167EFBE6EFD8320F26892DE6C4C3615E67558018662

Function 00B61F01 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

SR*n, xrefs: 00B62052

Memory Dump Source

Source File: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID:
String ID: SR*n
API String ID: 0-1386546681
Opcode ID: dfe7db30cee7185883cb60561941dc3e6e61fd3c79f135303a66e8ad24bbf13a
Instruction ID: 7ec6da843bc0aa574842195846c9e90378406df7cdf70740572063f2bfe5a351
Opcode Fuzzy Hash: dfe7db30cee7185883cb60561941dc3e6e61fd3c79f135303a66e8ad24bbf13a
Instruction Fuzzy Hash: 8F41B7B6A0C300AFE701AE5DDD8162AFBE6EFD8320F26892DE6C4C3615D63558018693

Function 00BB3A23 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00BB03A0: GetCurrentThreadId.KERNEL32 ref: 00BB03AF

Part of subcall function 00BB4AA1: IsBadWritePtr.KERNEL32(?,00000004), ref: 00BB4AAF

wsprintfA.USER32 ref: 00BB3A69
LoadImageA.USER32(?,?,?,?,?,?), ref: 00BB3B2D

Strings

%8x, xrefs: 00BB3AF7, 00BB3B2A
%8x, xrefs: 00BB3A64, 00BB3A67

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: 922b63eb8448b8c77393b9ccdb32dfa29f7e00a42d35de15c88ca35b3fb8b06c
Instruction ID: 6e2249e8679d80880ce05e6ca4c828c51ef9278957b39fcf4d03a60e4475cb0f
Opcode Fuzzy Hash: 922b63eb8448b8c77393b9ccdb32dfa29f7e00a42d35de15c88ca35b3fb8b06c
Instruction Fuzzy Hash: 7831047590010AFBCF11DFA4DD49EEEBBB5FF88700F108165FA11A61A0C7B19A61DB90

Function 00BB45F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(011B0174,00004020,00000000,-118F5FEC), ref: 00BB46E1

Strings

@, xrefs: 00BB4620

Memory Dump Source

Source File: 00000000.00000002.1499257247.0000000000BAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000000.00000002.1498790630.00000000009D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498815648.00000000009D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498832712.00000000009D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498849275.00000000009DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498866735.00000000009E4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498883440.00000000009E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1498907303.00000000009E6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499041474.0000000000B43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499059192.0000000000B46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499081940.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499116747.0000000000B6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499133075.0000000000B6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499149672.0000000000B6E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499164619.0000000000B6F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499197519.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499215061.0000000000B9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499231236.0000000000BA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499277964.0000000000BB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499301615.0000000000BB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499336558.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499356186.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499377385.0000000000BD5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499394258.0000000000BD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499484537.0000000000BDA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499503684.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499519797.0000000000BE2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499540242.0000000000BE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499558902.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499576634.0000000000BF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499593525.0000000000BFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499613056.0000000000BFC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499628247.0000000000BFE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499648445.0000000000C02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499666021.0000000000C04000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499682202.0000000000C07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499702283.0000000000C09000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499720015.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499741878.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499756945.0000000000C25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499789771.0000000000C71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499829353.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499845820.0000000000C84000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_uw7vXaPNPF.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 6d47164f672b556f6c59f50acc95b82df9d86e8fa0526ca5cc9250eb8ea92061
Instruction ID: ecc8e1c28699f5ac28e00ea682309a6939db80bcb5284a80a4409355a2573c93
Opcode Fuzzy Hash: 6d47164f672b556f6c59f50acc95b82df9d86e8fa0526ca5cc9250eb8ea92061
Instruction Fuzzy Hash: 4C318BB1504305EFDB24DF44D888BEEBBF0FF09300F108599E956676A1C3B1AAA5DB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uw7vXaPNPF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uw7vXaPNPF.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: uw7vXaPNPF.exePID: 7544, Parent PID: 3504

General

Chronological Activities

Disassembly

Analysis Process: uw7vXaPNPF.exePID: 7544, Parent PID: 3504COMMON

Execution Graph

Windows Analysis Report
uw7vXaPNPF.exe

Function 00BBDEF2 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 050915D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00BB1A73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00BBE91E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMON

Function 00BB1F79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00BB48D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00B710CF Relevance: 4.6, APIs: 3, Instructions: 72
registryCOMMON

Function 00BB0953 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00BB2062 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00BB4AEF Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00BB445B Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 050915C4 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Function 00B64F71 Relevance: 1.7, APIs: 1, Instructions: 170
COMMON

Function 00B6506B Relevance: 1.6, APIs: 1, Instructions: 142
fileCOMMON

Function 00B65050 Relevance: 1.6, APIs: 1, Instructions: 128
fileCOMMON