Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545822
MD5:	69e939844ed586ed304e0c4d9db0bfc4
SHA1:	8a89c259eb36e4c84a54b3334815102eb167e6eb
SHA256:	30b577b239e4946dc896a4fd26551414da9f1ddfd0de5a1b6d9f4cd31f05bb1c
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1372 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 69E939844ED586ED304E0C4D9DB0BFC4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 53%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A67CEA CryptVerifySignatureA,

0_2_00A67CEA

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2091221403.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9BE81

0_2_00A9BE81

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00A62CDF appears 35 times

Source: file.exe, 00000000.00000000.2076077593.0000000000886000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_051815D0 ChangeServiceConfigA,

0_2_051815D0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 53%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeW

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2809344 > 1048576

Source: file.exe

Static PE information: Raw size of ucxgvins is bigger than: 0x100000 < 0x2a7c00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.880000.0.unpack :EW;.rsrc:W;.idata :W;ucxgvins:EW;nulvttal:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2b0426 should be: 0x2affbf

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ucxgvins
Source: file.exe	Static PE information: section name: nulvttal
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088E5D6 push edx; mov dword ptr [esp], 3F7550F2h	0_2_0088EB0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008908F8 push eax; mov dword ptr [esp], esi	0_2_00895478
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12B01 push eax; mov dword ptr [esp], edi	0_2_00A12B8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12B01 push ebx; mov dword ptr [esp], 5BD75CEDh	0_2_00A12BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12B01 push ebx; mov dword ptr [esp], ebp	0_2_00A12BD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A190BE push eax; mov dword ptr [esp], ecx	0_2_00A190E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A210C9 push 484116D0h; mov dword ptr [esp], ebx	0_2_00A210D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200D3 push 6C3067C7h; mov dword ptr [esp], edx	0_2_00A218D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200D3 push 144709A0h; mov dword ptr [esp], esi	0_2_00A218DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008910F0 push eax; mov dword ptr [esp], ebx	0_2_00892C03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088D0F6 push edi; mov dword ptr [esp], edx	0_2_0088D5D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088D0F6 push esi; mov dword ptr [esp], ebp	0_2_0088D7B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A19005 push edx; mov dword ptr [esp], ecx	0_2_00A19025
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2000B push ecx; mov dword ptr [esp], edi	0_2_00A20690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2000B push ebp; mov dword ptr [esp], 29BBE150h	0_2_00A2223C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1B00C push dword ptr [edi+01h]; iretd	0_2_00A1B011
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1501E push ebp; mov dword ptr [esp], ecx	0_2_00A1501F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1501E push edx; mov dword ptr [esp], ecx	0_2_00A15407
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1506E push 2E36699Fh; mov dword ptr [esp], ebx	0_2_00A15073
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1506E push eax; mov dword ptr [esp], 248FE704h	0_2_00A15A7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00891054 push 23C2BDABh; mov dword ptr [esp], ebp	0_2_0089105D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1504A push 4203D500h; mov dword ptr [esp], ebp	0_2_00A1504F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1A04A push eax; mov dword ptr [esp], ebp	0_2_00A1A04B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088C187 push ebp; iretd	0_2_0088C188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD18A push 5362C22Bh; mov dword ptr [esp], eax	0_2_00AAD256
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD18A push edx; mov dword ptr [esp], 7F5FFAADh	0_2_00AAD25E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD18A push 3CB11EFFh; mov dword ptr [esp], edx	0_2_00AAD3ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A18185 push esi; mov dword ptr [esp], ecx	0_2_00A181B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A18185 push eax; mov dword ptr [esp], ecx	0_2_00A1820A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A18185 push 3B9D88ADh; mov dword ptr [esp], eax	0_2_00A182B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088F1A1 push esi; mov dword ptr [esp], esp	0_2_0088F529

Source: file.exe

Static PE information: section name: entropy: 7.791645043288012

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E4EB second address: 88E4F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06149 second address: A0617D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6A9D108ABCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F6A9D108AC8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6A9D108AAAh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0617D second address: A06181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06181 second address: A06185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06185 second address: A0618B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A129B0 second address: A129B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A129B9 second address: A129C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C80 second address: A12C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AAFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C94 second address: A12C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12C99 second address: A12CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F6A9D108AA6h 0x00000010 pop eax 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6A9D108AB9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12CC7 second address: A12CCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12F8F second address: A12F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13136 second address: A13156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F6A9CD4DB2Eh 0x0000000b pushad 0x0000000c ja 00007F6A9CD4DB26h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A132D3 second address: A132DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6A9D108AA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A132DF second address: A132F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F6A9CD4DB26h 0x0000000c jmp 00007F6A9CD4DB2Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A132F7 second address: A13319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F6A9D108ABAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A163CF second address: A163D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A163D8 second address: A163DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A164CC second address: A1652E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2441h], ebx 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D2E70h] 0x00000019 call 00007F6A9CD4DB29h 0x0000001e pushad 0x0000001f jmp 00007F6A9CD4DB2Eh 0x00000024 jmp 00007F6A9CD4DB2Eh 0x00000029 popad 0x0000002a push eax 0x0000002b jmp 00007F6A9CD4DB35h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 pushad 0x00000035 push ecx 0x00000036 pushad 0x00000037 popad 0x00000038 pop ecx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1652E second address: A16542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F6A9D108AA8h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16542 second address: A16566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edi 0x0000000e jng 00007F6A9CD4DB2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16566 second address: A165D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov ecx, dword ptr [ebp+122D2D40h] 0x0000000c mov esi, eax 0x0000000e push 00000003h 0x00000010 jmp 00007F6A9D108AB0h 0x00000015 push 00000000h 0x00000017 call 00007F6A9D108AB6h 0x0000001c sub ch, 00000002h 0x0000001f pop esi 0x00000020 push 00000003h 0x00000022 jnc 00007F6A9D108AACh 0x00000028 and esi, dword ptr [ebp+122D2EB8h] 0x0000002e call 00007F6A9D108AA9h 0x00000033 pushad 0x00000034 jmp 00007F6A9D108AB6h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A165D4 second address: A165F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F6A9CD4DB28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A165F4 second address: A16623 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007F6A9D108AAEh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F6A9D108AABh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16623 second address: A16661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jbe 00007F6A9CD4DB39h 0x0000000b popad 0x0000000c pop eax 0x0000000d mov cx, 6D06h 0x00000011 lea ebx, dword ptr [ebp+1245C2E3h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6A9CD4DB31h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16661 second address: A16667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16667 second address: A1666B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A166CF second address: A166F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F6A9D108AB3h 0x0000000f jl 00007F6A9D108AACh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A166F4 second address: A16737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push edx 0x00000007 mov dword ptr [ebp+122D2568h], ecx 0x0000000d pop esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F6A9CD4DB28h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov si, A035h 0x0000002e push 6EEC4E5Ah 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A167F2 second address: A167FC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6A9D108AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A167FC second address: A16816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6A9CD4DB35h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16816 second address: A16887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F6A9D108AB9h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F6A9D108AABh 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push ebx 0x0000001d push edx 0x0000001e pop edx 0x0000001f pop ebx 0x00000020 popad 0x00000021 pop eax 0x00000022 call 00007F6A9D108AAEh 0x00000027 or si, 339Eh 0x0000002c pop esi 0x0000002d mov edx, dword ptr [ebp+122D2E24h] 0x00000033 lea ebx, dword ptr [ebp+1245C2ECh] 0x00000039 mov dword ptr [ebp+122D1CF3h], edx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push ecx 0x00000043 jmp 00007F6A9D108AAAh 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16887 second address: A1688D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1694D second address: A16953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A353F9 second address: A353FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A356F2 second address: A356F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A356F6 second address: A35708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9CD4DB2Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35B6A second address: A35B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35B6F second address: A35B87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6A9CD4DB2Ch 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35B87 second address: A35B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35CD1 second address: A35CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35CD5 second address: A35CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35CD9 second address: A35CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6A9CD4DB34h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35CF3 second address: A35D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB9h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35E97 second address: A35E9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07BB5 second address: A07BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07BB9 second address: A07BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36BEB second address: A36BF4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36BF4 second address: A36BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36D59 second address: A36D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36D5D second address: A36D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A371D0 second address: A371D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E813 second address: A3E817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EDF5 second address: A3EE0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EE0E second address: A3EE14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EE14 second address: A3EE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EE18 second address: A3EE5F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6A9CD4DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007F6A9CD4DB40h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6A9CD4DB34h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EE5F second address: A3EE8D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6A9D108AA8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jmp 00007F6A9D108AAEh 0x00000014 jg 00007F6A9D108AA8h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EE8D second address: A3EE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EF69 second address: A3EF74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F6A9D108AA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EF74 second address: A3EFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jg 00007F6A9CD4DB2Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 jnp 00007F6A9CD4DB2Ch 0x00000019 pop ecx 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007F6A9CD4DB2Fh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EFB6 second address: A3EFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A425C5 second address: A425F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F6A9CD4DB35h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F6A9CD4DB30h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A425F3 second address: A42634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AB4h 0x00000009 jc 00007F6A9D108AA6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jo 00007F6A9D108ACBh 0x00000018 pushad 0x00000019 jmp 00007F6A9D108AB7h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42634 second address: A4263A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A427A2 second address: A427AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A427AC second address: A427B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A427B2 second address: A427DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 ja 00007F6A9D108AA6h 0x0000000e ja 00007F6A9D108AA6h 0x00000014 jg 00007F6A9D108AA6h 0x0000001a popad 0x0000001b jp 00007F6A9D108AACh 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A427DC second address: A427EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6A9CD4DB26h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42EBF second address: A42ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6A9D108AA6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42ECF second address: A42ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42ED5 second address: A42EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F6A9D108AA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42EE2 second address: A42F18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6A9CD4DB2Ch 0x0000000d popad 0x0000000e push edi 0x0000000f pushad 0x00000010 jmp 00007F6A9CD4DB34h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007F6A9CD4DB26h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43054 second address: A4305A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4305A second address: A4306A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007F6A9CD4DB26h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4306A second address: A43071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43071 second address: A43085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB2Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43085 second address: A43089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43089 second address: A4308D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4308D second address: A430B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c js 00007F6A9D108AA6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6A9D108AB5h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44062 second address: A44074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6A9CD4DB26h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44240 second address: A44246 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44D12 second address: A44D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007F6A9CD4DB26h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F6A9CD4DB26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44D29 second address: A44D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45296 second address: A4529C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A457C1 second address: A457C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A457C5 second address: A457CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A457CB second address: A457D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6A9D108AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A457D5 second address: A4585D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F6A9CD4DB28h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D24D4h], eax 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F6A9CD4DB28h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2745h], esi 0x0000004d push 00000000h 0x0000004f cld 0x00000050 jmp 00007F6A9CD4DB2Fh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F6A9CD4DB38h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4847E second address: A48498 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48498 second address: A4849E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A491F4 second address: A491FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4849E second address: A484A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E94F second address: A4E95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6A9D108AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E95A second address: A4E95F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53ADA second address: A53AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54BC4 second address: A54BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53AE0 second address: A53AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54BD0 second address: A54BDD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6A9CD4DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53AE4 second address: A53AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A569C7 second address: A56A2C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6A9CD4DB38h 0x00000008 jmp 00007F6A9CD4DB32h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 jnc 00007F6A9CD4DB29h 0x00000018 movsx edi, ax 0x0000001b mov ebx, ecx 0x0000001d push 00000000h 0x0000001f xor ebx, dword ptr [ebp+122D2B44h] 0x00000025 push 00000000h 0x00000027 jmp 00007F6A9CD4DB2Fh 0x0000002c xchg eax, esi 0x0000002d pushad 0x0000002e jmp 00007F6A9CD4DB36h 0x00000033 push ebx 0x00000034 push ecx 0x00000035 pop ecx 0x00000036 pop ebx 0x00000037 popad 0x00000038 push eax 0x00000039 push eax 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53B94 second address: A53B9E instructions: 0x00000000 rdtsc 0x00000002 js 00007F6A9D108AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C0E second address: A58C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C12 second address: A58C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6A9D108AB0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C2E second address: A58C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C32 second address: A58C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58C38 second address: A58C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59DF5 second address: A59E32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6A9D108AB5h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007F6A9D108AADh 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F6A9D108AA6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55C0E second address: A55C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6A9CD4DB26h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push ecx 0x0000000e jbe 00007F6A9CD4DB2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AE2C second address: A5AE32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61051 second address: A61066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6A9CD4DB2Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D16B second address: A6D188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AB9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D188 second address: A6D1A3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6A9CD4DB26h 0x00000008 jmp 00007F6A9CD4DB31h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D1A3 second address: A6D1D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ecx 0x0000000b jmp 00007F6A9D108AAFh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D1D1 second address: A6D1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74EEC second address: A74F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F6A9D108AAAh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F6A9D108AACh 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jmp 00007F6A9D108AABh 0x0000001c jbe 00007F6A9D108AACh 0x00000022 jns 00007F6A9D108AA6h 0x00000028 popad 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74F33 second address: A74F38 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74FFE second address: A75002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75002 second address: A75006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75006 second address: A7500C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7500C second address: A75039 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6A9CD4DB3Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F6A9CD4DB2Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75039 second address: A7503F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7503F second address: A75069 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6A9CD4DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F6A9CD4DB34h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75069 second address: A75094 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6A9D108AB9h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 ja 00007F6A9D108AA6h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75094 second address: A7509A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7509A second address: A7509E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B2F second address: A79B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B35 second address: A79B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F6A9D108AA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B43 second address: A79B56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B56 second address: A79B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B5A second address: A79B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F6A9CD4DB26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A552 second address: A7A558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A558 second address: A7A55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A867 second address: A7A86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9B2 second address: A7A9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A9B8 second address: A7A9BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB50 second address: A7AB5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB5B second address: A7AB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB65 second address: A7AB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6A9CD4DB26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB71 second address: A7AB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB7E second address: A7AB82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AB82 second address: A7AB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E1EA second address: A7E210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9CD4DB37h 0x00000009 jl 00007F6A9CD4DB26h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E210 second address: A7E21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9D108AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E21A second address: A7E21E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B934 second address: A4B93E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6A9D108AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C004 second address: A4C048 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 59DD5319h 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F6A9CD4DB28h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D284Bh], ebx 0x0000002d push 238B3714h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 jo 00007F6A9CD4DB26h 0x0000003b pop eax 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C048 second address: A4C04D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C353 second address: A4C370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6A9CD4DB36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C4C2 second address: A4C4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C4C6 second address: A4C4CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C804 second address: A4C809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C809 second address: A4C80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C953 second address: A4C958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CBF0 second address: A4CBF6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CBF6 second address: A2EFB1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6A9D108AACh 0x00000008 jnp 00007F6A9D108AA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 or dword ptr [ebp+122D2854h], ebx 0x00000017 call dword ptr [ebp+122D2AEAh] 0x0000001d pushad 0x0000001e jmp 00007F6A9D108AB8h 0x00000023 jmp 00007F6A9D108AB8h 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jnc 00007F6A9D108AA6h 0x00000031 jno 00007F6A9D108AA6h 0x00000037 popad 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B172 second address: A0B196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9CD4DB26h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6A9CD4DB30h 0x00000012 jnl 00007F6A9CD4DB26h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E512 second address: A7E51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F6A9D108AA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7ECDE second address: A7ECE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6A9CD4DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7ECE8 second address: A7ECF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F6A9D108AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7ECF8 second address: A7ED12 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6A9CD4DB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F6A9CD4DB48h 0x00000012 js 00007F6A9CD4DB42h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A842C8 second address: A842D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8460E second address: A84637 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6A9CD4DB26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F6A9CD4DB3Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84637 second address: A8463C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8463C second address: A84652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6A9CD4DB26h 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007F6A9CD4DB26h 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8477C second address: A847A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AAFh 0x00000007 jnl 00007F6A9D108AA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007F6A9D108AACh 0x00000015 jns 00007F6A9D108AA6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A847A1 second address: A847BC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6A9CD4DB30h 0x00000008 jmp 00007F6A9CD4DB2Ah 0x0000000d push ecx 0x0000000e jbe 00007F6A9CD4DB26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84D38 second address: A84D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84EBC second address: A84EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84EC5 second address: A84EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A851AC second address: A851D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9CD4DB26h 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F6A9CD4DB30h 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F6A9CD4DB26h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8533A second address: A85362 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6A9D108AA6h 0x00000008 jmp 00007F6A9D108AB5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jl 00007F6A9D108AA6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A857EA second address: A8580E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F6A9CD4DB31h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F6A9CD4DB32h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8580E second address: A85814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85814 second address: A85818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88EAA second address: A88ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6A9D108AB8h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88ECE second address: A88ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88ED2 second address: A88EF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F6A9D108AAAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88EF3 second address: A88EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6A9CD4DB26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C714 second address: A8C718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C718 second address: A8C734 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6A9CD4DB36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C734 second address: A8C744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A9D108AACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90D30 second address: A90D36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9104E second address: A9105D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F6A9D108AAEh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9105D second address: A91069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6A9CD4DB2Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9192D second address: A91948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91948 second address: A91977 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F6A9CD4DB26h 0x00000009 jmp 00007F6A9CD4DB37h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F6A9CD4DB2Ah 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91977 second address: A9197C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91C29 second address: A91C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91C2D second address: A91C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop esi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A948A0 second address: A948A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94B45 second address: A94B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94B4A second address: A94B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6A9CD4DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94B54 second address: A94B69 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6A9D108AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jnp 00007F6A9D108AACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A972F0 second address: A972FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 je 00007F6A9CD4DB26h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9702C second address: A97047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AB6h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BB7A second address: A9BB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B2E0 second address: A9B2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B43B second address: A9B444 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1338 second address: AA133C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FDFC second address: A9FE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FE02 second address: A9FE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FE0A second address: A9FE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FF4A second address: A9FF54 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6A9D108AB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FF54 second address: A9FF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0376 second address: AA037B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA037B second address: AA0390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB30h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C672 second address: A4C702 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F6A9D108AA6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F6A9D108AA8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+12491680h] 0x0000002f mov edi, dword ptr [ebp+122D2E9Ch] 0x00000035 push ebx 0x00000036 or dword ptr [ebp+1245A99Eh], esi 0x0000003c pop ecx 0x0000003d add eax, ebx 0x0000003f mov ecx, dword ptr [ebp+122D2086h] 0x00000045 sbb ecx, 5E2EA467h 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e pushad 0x0000004f popad 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 popad 0x00000053 pop edx 0x00000054 mov dword ptr [esp], eax 0x00000057 mov di, 3C5Bh 0x0000005b push 00000004h 0x0000005d push edi 0x0000005e cld 0x0000005f pop ecx 0x00000060 jc 00007F6A9D108AC1h 0x00000066 push eax 0x00000067 pushad 0x00000068 pushad 0x00000069 jng 00007F6A9D108AA6h 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA04FF second address: AA0503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0644 second address: AA0664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6A9D108AB9h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA106E second address: AA1082 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F6A9CD4DB26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F6A9CD4DB2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA513B second address: AA513F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA513F second address: AA5155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6A9CD4DB26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push edi 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4655 second address: AA4666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6A9D108AA6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA47F0 second address: AA480B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6A9CD4DB2Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA480B second address: AA480F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA480F second address: AA4813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4813 second address: AA4838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F6A9D108AAFh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4838 second address: AA485D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6A9CD4DB2Bh 0x00000008 jmp 00007F6A9CD4DB2Ch 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F6A9CD4DB26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA485D second address: AA4861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4861 second address: AA4865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA49BB second address: AA49CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6A9D108AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jc 00007F6A9D108AA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA49CF second address: AA49D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA49D3 second address: AA49ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9D108AB1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B48 second address: AA4B69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4CC0 second address: AA4CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4CC7 second address: AA4CE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F6A9CD4DB2Ch 0x0000000a popad 0x0000000b jbe 00007F6A9CD4DB2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4CE1 second address: AA4CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F6A9D108AACh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA54E second address: AAA558 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6A9CD4DB2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA7C9 second address: AAA7CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06138 second address: A06149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9CD4DB2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CBE4 second address: A4CBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAFF1 second address: AAAFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB2BE second address: AAB2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB2CA second address: AAB2F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F6A9CD4DB2Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB2F3 second address: AAB317 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6A9D108AAEh 0x0000000d jmp 00007F6A9D108AAEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB317 second address: AAB31B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABACB second address: AABAD5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6A9D108AA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC08B second address: AAC08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAC08F second address: AAC09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB01BA second address: AB01BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB01BE second address: AB01D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F6A9D108AA6h 0x0000000e jns 00007F6A9D108AA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0449 second address: AB0476 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6A9CD4DB26h 0x00000008 jnc 00007F6A9CD4DB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F6A9CD4DB2Dh 0x00000015 jmp 00007F6A9CD4DB2Ah 0x0000001a popad 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0476 second address: AB047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0898 second address: AB08AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6A9CD4DB2Eh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB08AB second address: AB08CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F6A9D108AB9h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB08CE second address: AB08D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB54DF second address: AB54E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCEE1 second address: ABCF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007F6A9CD4DB26h 0x0000000e pop edx 0x0000000f jmp 00007F6A9CD4DB38h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 jmp 00007F6A9CD4DB2Eh 0x0000001d push edx 0x0000001e pop edx 0x0000001f pop edx 0x00000020 jmp 00007F6A9CD4DB35h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCF32 second address: ABCF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABCF37 second address: ABCF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6A9CD4DB37h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB4CC second address: ABB4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB4D0 second address: ABB4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB4D6 second address: ABB50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F6A9D108AAEh 0x0000000c push ebx 0x0000000d push esi 0x0000000e jmp 00007F6A9D108AB9h 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB67A second address: ABB68B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6A9CD4DB2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB7DA second address: ABB7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6A9D108AA8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB7EA second address: ABB7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9CD4DB26h 0x0000000a pop edx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB7FD second address: ABB801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB801 second address: ABB805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB805 second address: ABB810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB810 second address: ABB81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB81A second address: ABB820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBACF second address: ABBAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBAD3 second address: ABBAD9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBAD9 second address: ABBADE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBEA5 second address: ABBECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6A9D108AB1h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F6A9D108AACh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBECF second address: ABBED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBED5 second address: ABBEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6A9D108AA6h 0x0000000a popad 0x0000000b jbe 00007F6A9D108AAEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABAC37 second address: ABAC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6A9CD4DB34h 0x0000000a jc 00007F6A9CD4DB28h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jno 00007F6A9CD4DB26h 0x0000001c push eax 0x0000001d pop eax 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC022D second address: AC0249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6A9D108AB1h 0x00000008 jc 00007F6A9D108AA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0249 second address: AC024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6E06 second address: AC6E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6E0A second address: AC6E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8897 second address: AC889D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD73DE second address: AD73E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD73E4 second address: AD73E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD73E9 second address: AD73F8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6A9CD4DB2Ah 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD73F8 second address: AD73FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD9E77 second address: AD9E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD9E7B second address: AD9E89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA58D second address: AEA59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 jo 00007F6A9CD4DB26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA3F2 second address: AEA40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F6A9D108AA6h 0x0000000c popad 0x0000000d jmp 00007F6A9D108AADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2A42 second address: AF2A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2A46 second address: AF2A57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jbe 00007F6A9D108AAEh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF17B3 second address: AF17B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF17B7 second address: AF17C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF17C5 second address: AF17C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF17C9 second address: AF17CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1BDA second address: AF1BF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9CD4DB30h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6D11 second address: AF6D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9D108AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6D1B second address: AF6D1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6D1F second address: AF6D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F6A9D108AA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B036E5 second address: B036F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F6A9CD4DB32h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B036F4 second address: B03703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6A9D108AA6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03703 second address: B03709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11D42 second address: B11D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13B6F second address: B13B73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B5B2 second address: B1B5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6A9D108AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A8F1 second address: B1A901 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6A9CD4DB32h 0x00000008 ja 00007F6A9CD4DB26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1AD42 second address: B1AD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F6A9D108AA8h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2282B second address: B2282F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2282F second address: B22860 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6A9D108AA6h 0x00000008 jmp 00007F6A9D108AB0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F6A9D108AADh 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F6A9D108AA6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22860 second address: B22866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22866 second address: B22889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6A9D108ABAh 0x0000000c jmp 00007F6A9D108AB2h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26C1F second address: B26C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26C23 second address: B26C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26C2D second address: B26C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6A9CD4DB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26C37 second address: B26C67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6A9D108AB7h 0x00000007 jmp 00007F6A9D108AB2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28BD7 second address: B28BE1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6A9CD4DB26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E83F second address: B1E877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b jmp 00007F6A9D108AADh 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6A9D108AB8h 0x0000001d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: ACE621 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7470000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A165B9 rdtsc

0_2_00A165B9

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1036

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A716BB GetSystemInfo,VirtualAlloc,

0_2_00A716BB

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A165B9 rdtsc

0_2_00A165B9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0088B7C6 LdrInitializeThunk,

0_2_0088B7C6

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: hProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A66E2C GetSystemTime,GetFileTime,

0_2_00A66E2C

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Process Injection	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Bypass User Account Control	1 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	54%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545822
Start date and time:	2024-10-31 05:02:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.416146573936089
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'809'344 bytes
MD5:	69e939844ed586ed304e0c4d9db0bfc4
SHA1:	8a89c259eb36e4c84a54b3334815102eb167e6eb
SHA256:	30b577b239e4946dc896a4fd26551414da9f1ddfd0de5a1b6d9f4cd31f05bb1c
SHA512:	f4ab5f667083dfeb02643d84a0c59ce19f6deb61bc5268df859f4c75b247bc48ebf80d3144eb3ff40c08c255405241132f6687bc2fe811205be9f85b817db5d1
SSDEEP:	24576:8gXDqv8VCSPwCzjdgbJxt16GA078YVNrjsZAiIp6GibE83DqqBo7esFJhb0VByDt:2v8EEvevT6GVNUuaWeqL4KxhK05Oh
TLSH:	4CD55AA1A009BACFD48F13755567CD836C5E03B8472508C7E86D66BABE63CD226F6C34
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....&.+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6A9C6AF7FAh
bsf ebp, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	f7c25c4d27cbb6637d3799f830bcb1eb	False	0.9331597222222222	data	7.791645043288012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ucxgvins	0xa000	0x2a8000	0x2a7c00	b4b7b272bf76d5db4d98591ef589e785	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nulvttal	0x2b2000	0x2000	0x600	2d32e31decb36f1cc160936afbff5250	False	0.59375	data	5.095404621557001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b4000	0x4000	0x2200	e0a7d6e3bd05015f62b85092703cef3b	False	0.05974264705882353	DOS executable (COM)	0.7346521921626852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	00:02:51
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x880000
File size:	2'809'344 bytes
MD5 hash:	69E939844ED586ED304E0C4D9DB0BFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	4.1%
Signature Coverage:	5.5%
Total number of Nodes:	366
Total number of Limit Nodes:	24

Executed Functions

Function 00A716BB Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11A45FEC), ref: 00A716C7
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00A71728

Memory Dump Source

Source File: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 61d6c2a50a99767732398601957a16e60c671a134ba78c5b10af09be72a90f82
Instruction ID: dca6287174f48058d12aade7a5e4c440419d94f808d843b09815887780979cd1
Opcode Fuzzy Hash: 61d6c2a50a99767732398601957a16e60c671a134ba78c5b10af09be72a90f82
Instruction Fuzzy Hash: 704123B2E40206AFE729CFB4CD49F96B7ECFB09741F048066A607DD482E67095D4CBA0

Function 051815D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 051818C8

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: c7356f0c7c382db3aa28546e84fbe8326ea64dd692dbac7dd69fd775d4c29fff
Instruction ID: c54e5c8f7010ca33d876bcfe06a8b8c8611cf01d4ae90dc5c94acef7d5625cbb
Opcode Fuzzy Hash: c7356f0c7c382db3aa28546e84fbe8326ea64dd692dbac7dd69fd775d4c29fff
Instruction Fuzzy Hash: 21C14D72D50659AFDB20EFA8C8857BEBBF2FB49310F148129E855E7240D7749882CF81

Function 00A165B9 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

C, xrefs: 00A16ADA

Memory Dump Source

Source File: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 0c220cb9b543b9a9bafcdb827fcf25b0ade66f19a5eb432cccb22b1a69c83432
Instruction ID: 9ab911ee823187111745d040de95e97eaec3b40917e3e5aeb411657848543435
Opcode Fuzzy Hash: 0c220cb9b543b9a9bafcdb827fcf25b0ade66f19a5eb432cccb22b1a69c83432
Instruction Fuzzy Hash: 8F2146B610D2859EE301CF685B905FEBBB9FA87330B34856BE441C6543E3614D8DA732

Function 0088B7C6 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0088B936

Memory Dump Source

Source File: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 7899dcfad58ebab7e2bdc8ac0835a740f12f61a540e49bb9e3108bd4791e1191
Instruction ID: f3e53f5c7183fd8b4fad9d25997b42e226c98f30a1ff7fec526b8749508b32fe
Opcode Fuzzy Hash: 7899dcfad58ebab7e2bdc8ac0835a740f12f61a540e49bb9e3108bd4791e1191
Instruction Fuzzy Hash: E1E0C2311089CE9ACB16BF688D0179A7B1DFBC1740FA01124FA01DAE5ADB3D5D118797

Function 00A643B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00A644C3
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00A644D7

Strings

.dll, xrefs: 00A643FA
.exe, xrefs: 00A6441E
1002, xrefs: 00A6448D

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: b4ad39e580e3ea81c894b7d0764c779f955ee48cf1caab55f0b3108e5868757e
Instruction ID: 772e518eaa0bdef4ccf7f58b8ad518564218fd488bf52f4daaf90758ea4492b7
Opcode Fuzzy Hash: b4ad39e580e3ea81c894b7d0764c779f955ee48cf1caab55f0b3108e5868757e
Instruction Fuzzy Hash: 9E31A97540420AEFCF25AF50DA0ABAE7B79FF08350F108169F90696561CB709AA0DF61

Function 00A648B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00A6484A,?,00000000,00000000), ref: 00A64975
GetModuleHandleA.KERNEL32(00000000,?,?,?,00A6484A,?,00000000,00000000), ref: 00A64983

Strings

.dll, xrefs: 00A648EB

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: ee4ba4f30c792a686dfe23965551eaaed98da872d6ec91e9ff653047ae04fc93
Instruction ID: a5ab23a912ad19aa6535fc5a6089fce071ba792cb19bbcf4bd8700b8ee3e3d9e
Opcode Fuzzy Hash: ee4ba4f30c792a686dfe23965551eaaed98da872d6ec91e9ff653047ae04fc93
Instruction Fuzzy Hash: 0D118B32184606EEFF349F24C949B9EBAB0FF48344F104225F812588E5D7B599E5DB92

Function 00A67212 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(013201FC,-11A45FEC), ref: 00A6728B
GetFileAttributesA.KERNEL32(00000000,-11A45FEC), ref: 00A67299

Strings

@, xrefs: 00A6723E

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 9dd20ff01e0e6ff4bd9caf67bc501a24aaa403c5dc45763b7f5ddb482c6bfeb1
Instruction ID: 7cf9b0a534d25b3fbfc3cd185344aef7ff28caf2a75fb4d33261ca5c73fe598a
Opcode Fuzzy Hash: 9dd20ff01e0e6ff4bd9caf67bc501a24aaa403c5dc45763b7f5ddb482c6bfeb1
Instruction Fuzzy Hash: B90169B0518604FAEF229F74CA1ABDDBBB0BF00348F204125F40769091DBB08A91EB44

Function 00A63292 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00A632F4

Strings

\\?\, xrefs: 00A6334F

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: a991cff0b40b20c4adf8601ea55e822caeb37d74d8c7d3267c6cc9261cc369f8
Instruction ID: 3660e434ec0bce18aebb67dc087415016e5ff280d7094d02b5effdc2a9f65472
Opcode Fuzzy Hash: a991cff0b40b20c4adf8601ea55e822caeb37d74d8c7d3267c6cc9261cc369f8
Instruction Fuzzy Hash: DB31E536A00609BFEF21DF94C949F9EBAB6FF48704F004155F901A91A0DB729A62DF90

Function 00A168B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A168BD

Strings

C, xrefs: 00A16ADA

Memory Dump Source

Source File: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 0465c71b71449f0770b5c91448ac929d30d3bf363872ca721a2fe1a138e95036
Instruction ID: 8ef2ca69f183d13254bdc98e6cd524db9156df0e69ce24075a6e327b54d9925e
Opcode Fuzzy Hash: 0465c71b71449f0770b5c91448ac929d30d3bf363872ca721a2fe1a138e95036
Instruction Fuzzy Hash: E9118CB250D2896FE3009F649E907FF3BB8EF96371F344556E584E3943D2250D458365

Function 00A649A1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00A64A05

Strings

.dll, xrefs: 00A649C2

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 05e997797d966b380908001178aa6286672b39de6678fe9249b291f95ce67203
Instruction ID: ce2bfc55d8776a9e40848660927ec6ffe46c722a1d2a7c0b2b626adb7b9197be
Opcode Fuzzy Hash: 05e997797d966b380908001178aa6286672b39de6678fe9249b291f95ce67203
Instruction Fuzzy Hash: 26F03A72100605EFDF20EF94D94ABAE7BB4BF18350F108225FE168A152D771C9A1DB22

Function 00A16A7A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A16A7F

Strings

C, xrefs: 00A16ADA

Memory Dump Source

Source File: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 7d96680b40fd162616f757f7aea72c484e83d30719ff614d9ded7bb7d1adede2
Instruction ID: 6b5471f6d926404955a53788b01a01f3aa902c278a74891aeda141d88e60bf04
Opcode Fuzzy Hash: 7d96680b40fd162616f757f7aea72c484e83d30719ff614d9ded7bb7d1adede2
Instruction Fuzzy Hash: C9E0D87254865E1EDB81EFA848523DD3BB0EF563A4F24C597DA49D7D82CA150C44834A

Function 00A6742E Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(013201FC,?,?,-11A45FEC,?,?,?,-11A45FEC,?), ref: 00A674E0

Part of subcall function 00A673E0: IsBadWritePtr.KERNEL32(?,00000004), ref: 00A673EE

CreateFileA.KERNEL32(?,?,?,-11A45FEC,?,?,?,-11A45FEC,?), ref: 00A67500

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 550c170ec6e0eafd2f944af5a857b61ac18a91cbaece07a2e1124c8fdb3a5fda
Instruction ID: 07fc387d1e65186b2b0e86b52126c5ba18d1e56518439fc7e1d5964d5f4d2d54
Opcode Fuzzy Hash: 550c170ec6e0eafd2f944af5a857b61ac18a91cbaece07a2e1124c8fdb3a5fda
Instruction Fuzzy Hash: BF11077211854AFBDF229FA0DD0DBAE3F71BF08348F148115F906280A1CB768AB1EB51

Function 00A66D9A Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

GetCurrentProcess.KERNEL32(-11A45FEC), ref: 00A66DA7
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A66E0D

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: 1c383411fc2abc9e65d815f7d29e60ae377efc18e10e8651613bcfa2a24db37d
Instruction ID: de7f05ac38409482c243c7b7a69859ed76dcbb7950bd633a09a54a4dfb3d29e0
Opcode Fuzzy Hash: 1c383411fc2abc9e65d815f7d29e60ae377efc18e10e8651613bcfa2a24db37d
Instruction Fuzzy Hash: 8D01313220088AFBCF22AFA4DD09E9E3F35FF587547048625F90690010C736C471EB62

Function 051815C4 Relevance: 1.8, APIs: 1, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 051818C8

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 2a7651ad3c6b593d35e61c155e1ea65d47f05905dcbc0e39bd2b62c732632b47
Instruction ID: 78f0ebdabf1cece4dbce85ade9b19203937748326a9b5f9a040d32239d8d64b0
Opcode Fuzzy Hash: 2a7651ad3c6b593d35e61c155e1ea65d47f05905dcbc0e39bd2b62c732632b47
Instruction Fuzzy Hash: 79C15C72D50659AFDB20EFA8C8857BEBBF2FB49310F148129E855E7240D7749882CF81

Function 00A720E7 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63186028257230b9b87acc76326835e387f7919438eea6f8ed5a640cd5570f18
Instruction ID: 08a1ec7314673375a8b309d770601c7ac3bbdc6dce583335784daae6599a1aa9
Opcode Fuzzy Hash: 63186028257230b9b87acc76326835e387f7919438eea6f8ed5a640cd5570f18
Instruction Fuzzy Hash: 4D418E72904205EFEB25DF54CD44BA977B1FF00314F24C154E61AAA592D371EC90DB91

Function 00A12B01 Relevance: 1.6, APIs: 1, Instructions: 106
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A12B01

Memory Dump Source

Source File: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 49ec54c3926650153e1d8e9f8b7b9d740c524041e34725849da57980cfa4e2d2
Instruction ID: facd4474e8a12cd7fbf95c29433b14fea64e5a6bffc711e5f258e259b7dc1f98
Opcode Fuzzy Hash: 49ec54c3926650153e1d8e9f8b7b9d740c524041e34725849da57980cfa4e2d2
Instruction Fuzzy Hash: 27315DF210C704AFD345AF19EC857BAFBE8EF54750F46092DE2C483650EA3198908B9B

Function 00A65419 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00A654CE

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a2d90c7dfc93a9166b4ded6926029961554a0a07f8d2daaad7c61dd963bbc6c3
Instruction ID: 1fbb77c371a173d0f77f7d7fef8d127636d02cc05d054082d8c81f4cebed017a
Opcode Fuzzy Hash: a2d90c7dfc93a9166b4ded6926029961554a0a07f8d2daaad7c61dd963bbc6c3
Instruction Fuzzy Hash: 2B318D71900604FEEB20DFA4DC49FAEBBB9FF04714F208269F506AA1D1C7719A42CB10

Function 00A64C35 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00A64CB7

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8eb4fc6ec6ae603f3e12f534e5f8f302fa6d050247baf947dd908f1288d9f67b
Instruction ID: 3a284d659164078617002260308e420bf9226672cccc6bd8cbb7c11bcdc93ec2
Opcode Fuzzy Hash: 8eb4fc6ec6ae603f3e12f534e5f8f302fa6d050247baf947dd908f1288d9f67b
Instruction Fuzzy Hash: 77319371940204BEEB30DFA4DC45F9D7BB8EB08724F208365F616EE1D1D7B5A5428B54

Function 00A71E34 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00A71EE1

Memory Dump Source

Source File: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 323ac705ee511b3e196c48aa4bde7f2a6b82e2845cce4e60f0c5858567644e08
Instruction ID: ed8192111043e430c2b3ffd803b9dcda927059a46000f4b3c9699ea051daf410
Opcode Fuzzy Hash: 323ac705ee511b3e196c48aa4bde7f2a6b82e2845cce4e60f0c5858567644e08
Instruction Fuzzy Hash: AF119371A012289FEB304B1C8C48BBBB7FCEF447A1F20C496F909A6045E7749D809AA5

Function 05180D42 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05180DCD

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9709926dec5f6d4f2e8f2bacbab68522ed4d6d12dbbe2b7d169e52edb1b73e23
Instruction ID: dcabd988e9c35efe1c18f5bd27fa27fe48694dd4a99edb5ccdbb691901a2b252
Opcode Fuzzy Hash: 9709926dec5f6d4f2e8f2bacbab68522ed4d6d12dbbe2b7d169e52edb1b73e23
Instruction Fuzzy Hash: 6B2137BA8052099FCB50DF99D984ADEFBF4FB88710F14821AD909AB204D774A544CFA4

Function 05180D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05180DCD

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: ea9256f26fbe6dc3bad98b03bb0f9832d5fd386ce31244127f8b14a8c90c5f1a
Instruction ID: 0600961063132c103ca5a397dbaab9bd43b5f95659f9e2fbfe06f4a42d82719a
Opcode Fuzzy Hash: ea9256f26fbe6dc3bad98b03bb0f9832d5fd386ce31244127f8b14a8c90c5f1a
Instruction Fuzzy Hash: 8E2137BA8012099FCB50DF99D984ADEFBF4FB88710F14821AD909AB204D774A544CFA4

Function 05181510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05181580

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: fc99794cea96e7f7849d5de5f39300be8e373bea006432aaa9ac430a1159af30
Instruction ID: b0898949123c40f5e780bd067793dbd6d73f9bcce78f2fb523c64438b5302e5d
Opcode Fuzzy Hash: fc99794cea96e7f7849d5de5f39300be8e373bea006432aaa9ac430a1159af30
Instruction Fuzzy Hash: EA1106B29002499FDB10CF9AC584BDEFBF4AB48320F108029E519A3240D778A544CFA5

Function 05181509 Relevance: 1.6, APIs: 1, Instructions: 53serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05181580

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: de729e4ea2e21ecd1af2e0c30414ab4bfb16647e36691a69e16d6d1ad88bd3d4
Instruction ID: a657e581f4715a9845816f1ce508aaf026d263759d0fa82e95479141b9650780
Opcode Fuzzy Hash: de729e4ea2e21ecd1af2e0c30414ab4bfb16647e36691a69e16d6d1ad88bd3d4
Instruction Fuzzy Hash: 922117B6D00209DFDB20CF9AC584BDEFBF4BB48320F10842AD519A7240D778A644CFA5

Function 00A67F66 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11A45FEC), ref: 00A67FED

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: b0196fc9785f35727a37fdea68e82982bc9fe28d317a613ddd533b649efd6a9d
Instruction ID: 6bf3a2888f09ef6728b2d302481a7b3e7c2434ab41b8997995a7ac1bac85ec66
Opcode Fuzzy Hash: b0196fc9785f35727a37fdea68e82982bc9fe28d317a613ddd533b649efd6a9d
Instruction Fuzzy Hash: D811C53210450AEFCF22AFA4DD09D9E3F7AFF58354B014A11F91255421CB3AC4B6EB61

Function 00A67D4E Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4446e41de06dedf1e39cf7849270332af7076d62ddc61b3ac202f53b362623b8
Instruction ID: 72888cd97b116304b9df372667660bc25a7b53e285c6e8b3882e27b508b2fadc
Opcode Fuzzy Hash: 4446e41de06dedf1e39cf7849270332af7076d62ddc61b3ac202f53b362623b8
Instruction Fuzzy Hash: 9B11217151454AEFCF22AFA4C909FAE3B76FF45348F108915F90246061D735C965EF60

Function 05181301 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05181367

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 47072f1e9d0cf158a4f12cf364113d261da730272e0a8f1334119c9b35c8c896
Instruction ID: f4719ec449e31d66a9ff50cfd21175f703ffed0e94220bcbdb4c255284bfcfa6
Opcode Fuzzy Hash: 47072f1e9d0cf158a4f12cf364113d261da730272e0a8f1334119c9b35c8c896
Instruction Fuzzy Hash: E01128B2900249DFDB10CF9AC985BDEBBF4EF48724F14846AD518A3240D778A544CFA5

Function 05181308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05181367

Memory Dump Source

Source File: 00000000.00000002.2226310361.0000000005180000.00000040.00000800.00020000.00000000.sdmp, Offset: 05180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5180000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 6d9424b90ae5f1cfed3533c06d482b1fa8d94a09d9f9bc54420951f8cdf8e92f
Instruction ID: 3b93713cd81c902e74cc579980f48157982f2f1eaaa71ef5e87df7c91a072048
Opcode Fuzzy Hash: 6d9424b90ae5f1cfed3533c06d482b1fa8d94a09d9f9bc54420951f8cdf8e92f
Instruction Fuzzy Hash: 0C1125B2900249CFDB20CF9AC544BEEBBF4AB48724F20846AD518A3240D778A544CFA5

Function 00A67632 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11A45FEC,?,?,00A65361,?,?,00000400,?,00000000,?,00000000), ref: 00A6769E

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: ee5fcba36f28a55c7ea9859e8106620687fd8cc2e6646a296d6ae3b0def3b387
Instruction ID: 5b25daa5e7cbc8c0731c996a2b182306217050cd4a02327d5c6b0c774fe7d254
Opcode Fuzzy Hash: ee5fcba36f28a55c7ea9859e8106620687fd8cc2e6646a296d6ae3b0def3b387
Instruction Fuzzy Hash: A3F0373610494AFFCF12AFA8DD09E8E3B36FF48344F104122F9124A021D736C4A1EB62

Function 00A1FE79 Relevance: 1.5, APIs: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00A1FE87

Memory Dump Source

Source File: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89a5096c08ba00581458cea7601f2a21103de587e5e3ca44854f9901219e6d2b
Instruction ID: ca5f4d0ef696b4e5e90a9fc55acf417f22949510716b1e3607fbc487d3eab428
Opcode Fuzzy Hash: 89a5096c08ba00581458cea7601f2a21103de587e5e3ca44854f9901219e6d2b
Instruction Fuzzy Hash: A0D0C7F354D226BE7650DAAD7908D7737BCD945794730D939F44AC2501E1204840A761

Function 0088E5D6 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0088EAFF

Memory Dump Source

Source File: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7e30c24885677293993dfe4104a6cdac60492803808b987fd15b6f735572f266
Instruction ID: 1119cf84f17b9b164de13b94a83daf4d1573801097809ff7c9a8979c554dbae9
Opcode Fuzzy Hash: 7e30c24885677293993dfe4104a6cdac60492803808b987fd15b6f735572f266
Instruction Fuzzy Hash: 171166B250C224EFD7017F68D8886AEFBE4FF54720F12492DEAD586250E3314860DB93

Function 00A62EB0 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00A62F14

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 984ba31360eaeec170452382ef10201732fccee02a0661a38d0e7af815493fd2
Instruction ID: 649f5b90ac55e93ed247e18616324c1ec49c3d9449d317d396999b7ddd9994be
Opcode Fuzzy Hash: 984ba31360eaeec170452382ef10201732fccee02a0661a38d0e7af815493fd2
Instruction Fuzzy Hash: F401E436A0450ABFDF22AFA5CC05E9EBB76EF49340F005261F905A4164E7329A61DF60

Function 00A71A5E Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00A71A5A,?,?,00A71760,?,?,00A71760,?,?,00A71760), ref: 00A71A7E

Memory Dump Source

Source File: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cfb95ae2581894e24946a603fb9b4f3def55d95379666b79e027fc692396c476
Instruction ID: 0cfc175df4cd0aa2875d7ddb4303ec0bd8287d28649b7860a185f72bb86521db
Opcode Fuzzy Hash: cfb95ae2581894e24946a603fb9b4f3def55d95379666b79e027fc692396c476
Instruction Fuzzy Hash: 6DF081B1902206EFD725CF18CD09B59BBE4FF457A2F11C065F44EAB591E3B198D08B50

Function 00A65A33 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

CloseHandle.KERNELBASE(00A653F6,-11A45FEC,?,?,00A653F6,?), ref: 00A65A71

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: c96334833fe3eea157154b913acc5c423f2d11149db61f06db19269b37b0500b
Instruction ID: c44ed3d8e72f69ef3fcc6898ce88a5cb66bff15aa04c22fcabb976f457cefdcf
Opcode Fuzzy Hash: c96334833fe3eea157154b913acc5c423f2d11149db61f06db19269b37b0500b
Instruction Fuzzy Hash: 49E08672600D42FACF20BFB8DE0DF4E2B79AFA1384B004332F50396055EA25C591D761

Function 0088F081 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0088F75B

Memory Dump Source

Source File: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: caccb7c1c547ad26ba3facf72d43026070f15b155d78b39aeea786ad9b7cee20
Instruction ID: 1ab17da8d15d9d8d1a4efa1701952b1b19b74d5c75f47623cbfedc0a3ba7e14f
Opcode Fuzzy Hash: caccb7c1c547ad26ba3facf72d43026070f15b155d78b39aeea786ad9b7cee20
Instruction Fuzzy Hash: 3EE09275008A098FDB497F7084991AEBBA0FF18321F124A2DD9E286681D7310C90CB06

Function 00A64AF8 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00A62B7E,?,?), ref: 00A64AFE

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6b717ccb8e0b56f993069164a6747538ed2d4f2fbc21596620b7c5825725f706
Instruction ID: 59e8da747a340d7d9ed46db7e9376236b9c9a15eccf8ac883496517a98abcc32
Opcode Fuzzy Hash: 6b717ccb8e0b56f993069164a6747538ed2d4f2fbc21596620b7c5825725f706
Instruction Fuzzy Hash: CAB09232040108BFCB11FF91DC0684DBF7AFF293D8B108120F90B84061CB72EA609B98

Non-executed Functions

Function 00A66E2C Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

GetSystemTime.KERNEL32(?,-11A45FEC), ref: 00A66E61
GetFileTime.KERNEL32(?,?,?,?,-11A45FEC), ref: 00A66EA4

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: 7ea58dab483ea1b2d2b4ba67b4d8bfaf731bfa62c9562c1b5a494d6f34969468
Instruction ID: cedd1ebdc2d5378556622b76e06e1f6e54b1590d887b23aca33f9843693696fb
Opcode Fuzzy Hash: 7ea58dab483ea1b2d2b4ba67b4d8bfaf731bfa62c9562c1b5a494d6f34969468
Instruction Fuzzy Hash: A201E83210448AFFCF219F69DE08E8F7F75FF95311B104226F40245460C77298A1DB61

Function 00A67CEA Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00A67D31

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 85e800bf228a360db85f55b7d7bed66b8cd51b5aa3ca6eabcf5cc4a44e64b676
Instruction ID: 1bc00091c78e154a67ba9e9ecff2736d2a3c76c61689027ee6f1641beeda87a6
Opcode Fuzzy Hash: 85e800bf228a360db85f55b7d7bed66b8cd51b5aa3ca6eabcf5cc4a44e64b676
Instruction Fuzzy Hash: 0DF01C3260520EFFCF01DF94C904A9C7B72FF19318B108525FA16A6160D7B5DA60EF40

Function 00A9BE81 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c041874a3e4b0069d36a5d42d38f22fdff520fe9802945bde26b430c89d0e156
Instruction ID: f2b10e7f0524e2c6f2c997acac4a57e6422db94ce74c234a6fb853dacc8df5c9
Opcode Fuzzy Hash: c041874a3e4b0069d36a5d42d38f22fdff520fe9802945bde26b430c89d0e156
Instruction Fuzzy Hash: EB214A7261CB14CFCB497F29AA8157AF7F4BF44710F26082ED5C687200EB309581AB97

Function 00A66362 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00A62CDF: GetCurrentThreadId.KERNEL32 ref: 00A62CEE

Part of subcall function 00A673E0: IsBadWritePtr.KERNEL32(?,00000004), ref: 00A673EE

wsprintfA.USER32 ref: 00A663A8
LoadImageA.USER32(?,?,?,?,?,?), ref: 00A6646C

Strings

%8x, xrefs: 00A663A3, 00A663A6
%8x, xrefs: 00A66436, 00A66469

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: eeea8717f66a04433653a59409dc0476b72c12aded0594331ec8e035dd35adb9
Instruction ID: 31e1b683490f5c533d6e4566f72f25313d0f0cc6729ab7eb962c95bd130e3271
Opcode Fuzzy Hash: eeea8717f66a04433653a59409dc0476b72c12aded0594331ec8e035dd35adb9
Instruction Fuzzy Hash: 1931E67190010AFBDF11DF94DD49EEEBB79FF88710F108125FA12A61A0C7719A61DB51

Function 00A66F33 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(013201FC,00004020,00000000,-11A45FEC), ref: 00A67020

Strings

@, xrefs: 00A66F5F

Memory Dump Source

Source File: 00000000.00000002.2224616439.0000000000A5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.2224263655.0000000000880000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224282279.0000000000882000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224295213.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224307753.000000000088A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224321653.0000000000896000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224416421.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224429599.0000000000A00000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224446010.0000000000A10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224458387.0000000000A13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224470504.0000000000A1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224496057.0000000000A23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224508149.0000000000A28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224521301.0000000000A2F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224533035.0000000000A30000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224545413.0000000000A31000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224557990.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224570579.0000000000A33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224584816.0000000000A34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224601494.0000000000A4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224629517.0000000000A6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224645546.0000000000A6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224663138.0000000000A7C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224676850.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224690158.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224701552.0000000000A89000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224715607.0000000000A91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224727240.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224738175.0000000000A93000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224755376.0000000000A97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224772223.0000000000AA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224784980.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224797443.0000000000AA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224808751.0000000000AA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224819584.0000000000AA6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224831109.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224841965.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224854275.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224868115.0000000000AAC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224884978.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224899515.0000000000AB4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224910859.0000000000AB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224922581.0000000000AB6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224934749.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224967295.0000000000B13000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224980102.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B1D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2224994328.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225019209.0000000000B32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2225030515.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: d283adc2723f0ba4483fd722a05703a535e413470a328e67795ff0613d3fb737
Instruction ID: 73a57ad9fe2d175f0fc95fa563a13e1bd0f6eda9445968434f2975f29d766631
Opcode Fuzzy Hash: d283adc2723f0ba4483fd722a05703a535e413470a328e67795ff0613d3fb737
Instruction Fuzzy Hash: 45317AB1508705EFDB258F54C848B9EBBB0FF08314F108529F95667690C3B4AAA5DB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 1372, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 1372, Parent PID: 4004COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00A716BB Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 051815D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00A643B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00A648B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00A67212 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00A63292 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00A168B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
fileCOMMON

Function 00A649A1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00A16A7A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
fileCOMMON

Function 00A6742E Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00A66D9A Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 051815C4 Relevance: 1.8, APIs: 1, Instructions: 300
COMMON

Function 00A720E7 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00A12B01 Relevance: 1.6, APIs: 1, Instructions: 106
libraryCOMMON

Function 00A65419 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON