Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561484
MD5:	2636521bdc04a44fcfa2f00957445a04
SHA1:	410cdacf1d5343680913c86746b908f8e2f4fe86
SHA256:	6ec188e021ed6d5a7dbe083969e72adb44dc23165cad269113c0bd0a726b5187
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2636521BDC04A44FCFA2F00957445A04)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2127910865.00000000052A0000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051BC	0_2_00B051BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051A8	0_2_00B051A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051FB	0_2_00B051FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051CF	0_2_00B051CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDA5BE	0_2_00BDA5BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEE8C9	0_2_00AEE8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEE982	0_2_00AEE982
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7CC42	0_2_00B7CC42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6FDAE	0_2_00B6FDAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096DDBC	0_2_0096DDBC

Source: file.exe, 00000000.00000000.2114905910.0000000000966000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2262384154.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2805248 > 1048576

Source: file.exe

Static PE information: Raw size of idwitinv is bigger than: 0x100000 < 0x2a6c00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.960000.0.unpack :EW;.rsrc:W;.idata :W;idwitinv:EW;mjfbzujg:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2b3856 should be: 0x2b4fea

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: idwitinv
Source: file.exe	Static PE information: section name: mjfbzujg
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096EF93 push eax; mov dword ptr [esp], 72E5463Dh	0_2_0096F810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009730B3 push 52EC72D2h; mov dword ptr [esp], ecx	0_2_009730C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFA09F push ebp; mov dword ptr [esp], 049C076Bh	0_2_00AFC789
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B07081 push 0E9753D7h; mov dword ptr [esp], ecx	0_2_00B07185
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B060FE push eax; mov dword ptr [esp], 7DDBC6B3h	0_2_00B06114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B060FE push ebp; mov dword ptr [esp], ebx	0_2_00B0619A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFA0FC push ebp; mov dword ptr [esp], edi	0_2_00AFA0FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFC0C7 push ebp; mov dword ptr [esp], 00000004h	0_2_00AFC0CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF60C1 push edi; mov dword ptr [esp], 27EFE512h	0_2_00AF60C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF70C1 push 5CB00123h; mov dword ptr [esp], edx	0_2_00AF7229
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009710E5 push 4878D682h; mov dword ptr [esp], eax	0_2_009743A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B110C5 push 053A049Bh; mov dword ptr [esp], ecx	0_2_00B110D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096C014 push 4484BB1Ch; mov dword ptr [esp], eax	0_2_0096C01C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096C014 push 241F1F4Ah; mov dword ptr [esp], esp	0_2_0096C024
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097101D push 1E27F2ABh; mov dword ptr [esp], ecx	0_2_009738BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFC03D push eax; mov dword ptr [esp], 78DE43C5h	0_2_00AFC078
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0200A push eax; mov dword ptr [esp], ecx	0_2_00B0200E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096D056 push ebp; mov dword ptr [esp], 2D5FA9B6h	0_2_0096D058
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00972050 push ebx; mov dword ptr [esp], ebp	0_2_00975108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B07055 push 2CD67263h; mov dword ptr [esp], ebp	0_2_00B07329
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097307C push 2965C800h; mov dword ptr [esp], ebp	0_2_00974335
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEF051 push edi; mov dword ptr [esp], 3EC38D26h	0_2_00AEF312
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC01B4 push 0771C3C3h; mov dword ptr [esp], edi	0_2_00BC0B8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051BC push ebx; mov dword ptr [esp], edx	0_2_00B05279
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051BC push ebp; mov dword ptr [esp], edx	0_2_00B052A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051BC push ecx; mov dword ptr [esp], esi	0_2_00B052C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00974182 push eax; mov dword ptr [esp], ebx	0_2_00974FF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051A8 push ebx; mov dword ptr [esp], edx	0_2_00B05279
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051A8 push ebp; mov dword ptr [esp], edx	0_2_00B052A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B051A8 push ecx; mov dword ptr [esp], esi	0_2_00B052C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFB198 push 3CFD7600h; mov dword ptr [esp], edx	0_2_00AFB1B7

Source: file.exe

Static PE information: section name: entropy: 7.804898343067434

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3F0 second address: 96E3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3F5 second address: 96E3FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E3FA second address: 96E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA3B8E71766h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jnc 00007FA3B8E7176Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA3B8E71771h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E428 second address: 96E42C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE5D1 second address: AEE5D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE5D6 second address: AEE5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDB62 second address: AEDB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDD1A second address: AEDD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnc 00007FA3B88AB016h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDD2D second address: AEDD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDD31 second address: AEDD35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF058D second address: AF066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E71774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ecx, edi 0x0000000c push 00000000h 0x0000000e jng 00007FA3B8E7176Bh 0x00000014 mov ecx, 2A566537h 0x00000019 push 6CA40161h 0x0000001e pushad 0x0000001f jmp 00007FA3B8E7176Dh 0x00000024 jmp 00007FA3B8E71772h 0x00000029 popad 0x0000002a xor dword ptr [esp], 6CA401E1h 0x00000031 push 00000003h 0x00000033 xor si, FE0Fh 0x00000038 push 00000000h 0x0000003a mov edx, dword ptr [ebp+122D3AFCh] 0x00000040 push 00000003h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007FA3B8E71768h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 00000019h 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c push 4FAE8B35h 0x00000061 jmp 00007FA3B8E71770h 0x00000066 add dword ptr [esp], 705174CBh 0x0000006d mov ecx, edi 0x0000006f lea ebx, dword ptr [ebp+12456465h] 0x00000075 call 00007FA3B8E71779h 0x0000007a mov ecx, dword ptr [ebp+122D39F8h] 0x00000080 pop ecx 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007FA3B8E71774h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF070E second address: AF0712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0712 second address: AF071C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF071C second address: AF0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB022h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push ecx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ecx 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jc 00007FA3B88AB022h 0x0000001f jmp 00007FA3B88AB01Ch 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0757 second address: AF0769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jbe 00007FA3B8E71770h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0769 second address: AF0793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA3B88AB029h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0793 second address: AF0825 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c jmp 00007FA3B8E7176Eh 0x00000011 push 00000003h 0x00000013 sub dword ptr [ebp+122D1EAFh], edx 0x00000019 push 00000000h 0x0000001b add si, D6EBh 0x00000020 push 00000003h 0x00000022 push 6C063400h 0x00000027 jnc 00007FA3B8E7177Ah 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 jmp 00007FA3B8E71770h 0x00000035 popad 0x00000036 add dword ptr [esp], 53F9CC00h 0x0000003d mov edi, dword ptr [ebp+122D38A8h] 0x00000043 lea ebx, dword ptr [ebp+1245646Eh] 0x00000049 push 00000000h 0x0000004b push eax 0x0000004c call 00007FA3B8E71768h 0x00000051 pop eax 0x00000052 mov dword ptr [esp+04h], eax 0x00000056 add dword ptr [esp+04h], 00000018h 0x0000005e inc eax 0x0000005f push eax 0x00000060 ret 0x00000061 pop eax 0x00000062 ret 0x00000063 movsx esi, si 0x00000066 xchg eax, ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FA3B8E7176Dh 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0825 second address: AF082B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF082B second address: AF0845 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jno 00007FA3B8E7176Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0845 second address: AF0849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF08E6 second address: AF0990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 7058B2D1h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FA3B8E71768h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov esi, dword ptr [ebp+122D38E8h] 0x0000002d push 00000003h 0x0000002f sbb dx, E8CFh 0x00000034 push 00000000h 0x00000036 jmp 00007FA3B8E71776h 0x0000003b jng 00007FA3B8E7176Ah 0x00000041 mov si, C4F1h 0x00000045 push 00000003h 0x00000047 mov di, 7A61h 0x0000004b push 8970D800h 0x00000050 jmp 00007FA3B8E71776h 0x00000055 xor dword ptr [esp], 4970D800h 0x0000005c mov dword ptr [ebp+122D1E49h], ecx 0x00000062 lea ebx, dword ptr [ebp+12456479h] 0x00000068 call 00007FA3B8E7176Eh 0x0000006d mov edx, dword ptr [ebp+122D3B2Ch] 0x00000073 pop edx 0x00000074 xchg eax, ebx 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0990 second address: AF0996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0996 second address: AF099B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF099B second address: AF09AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12465 second address: B1246B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1246B second address: B12494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FA3B88AB027h 0x0000000c jmp 00007FA3B88AB01Ah 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A72 second address: AE5A94 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3B8E71776h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A94 second address: AE5A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10453 second address: B10477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a jmp 00007FA3B8E71773h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10477 second address: B1047B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1047B second address: B1047F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1089F second address: B108B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA3B88AB01Bh 0x0000000c ja 00007FA3B88AB016h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10CBB second address: B10CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA3B8E71778h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10CDC second address: B10D11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007FA3B88AB029h 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1100A second address: B11010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11173 second address: B11182 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FA3B88AB016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11182 second address: B11188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11188 second address: B1118D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11440 second address: B11444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11444 second address: B11466 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007FA3B88AB024h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11466 second address: B1147F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E71775h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1147F second address: B11483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11483 second address: B11493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA3B8E71766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11493 second address: B11499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE404F second address: AE4053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4053 second address: AE4068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA3B88AB01Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B115C0 second address: B115CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B115CB second address: B115E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jnl 00007FA3B88AB016h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jl 00007FA3B88AB016h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B115E9 second address: B115F3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11B6A second address: B11B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1200D second address: B12011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12011 second address: B1201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1201C second address: B12023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12023 second address: B12042 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA3B88AB02Ah 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B147A3 second address: B147A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1663E second address: B1668E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB028h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FA3B88AB01Eh 0x00000011 jmp 00007FA3B88AB023h 0x00000016 popad 0x00000017 pushad 0x00000018 jnp 00007FA3B88AB016h 0x0000001e jno 00007FA3B88AB016h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4F39 second address: AD4F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D3C0 second address: B1D3D4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FA3B88AB016h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D3D4 second address: B1D3D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D695 second address: B1D69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D69B second address: B1D69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D69F second address: B1D6AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D6AA second address: B1D6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D6B3 second address: B1D6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D802 second address: B1D82E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA3B8E7176Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007FA3B8E71770h 0x00000011 pop edi 0x00000012 pushad 0x00000013 jng 00007FA3B8E71766h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F63D second address: B1F641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F9A5 second address: B1F9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B202D2 second address: B202D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B202D8 second address: B20309 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA3B8E71771h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA3B8E71779h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B203E0 second address: B20418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB01Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FA3B88AB018h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 nop 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20418 second address: B20422 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2095E second address: B20966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20966 second address: B2096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2096A second address: B2098E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov esi, 03F3F393h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 jmp 00007FA3B88AB01Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21679 second address: B2167D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2167D second address: B21683 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21683 second address: B21689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21689 second address: B2168D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2168D second address: B21691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21691 second address: B21708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FA3B88AB027h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA3B88AB018h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov edi, ebx 0x0000002c mov edi, 283E1447h 0x00000031 xor dword ptr [ebp+122D1DE2h], ebx 0x00000037 push 00000000h 0x00000039 or dword ptr [ebp+122D26D1h], ebx 0x0000003f call 00007FA3B88AB01Bh 0x00000044 cmc 0x00000045 pop edi 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FA3B88AB023h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24C31 second address: B24C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24C3E second address: B24C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24C42 second address: B24C4C instructions: 0x00000000 rdtsc 0x00000002 js 00007FA3B8E71766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239BD second address: B239C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239C1 second address: B239C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239C7 second address: B239D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA3B88AB016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25254 second address: B25258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25258 second address: B252B9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jmp 00007FA3B88AB01Fh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FA3B88AB018h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c cld 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 mov edi, dword ptr [ebp+122D3C00h] 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FA3B88AB027h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25F12 second address: B25F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2695F second address: B26963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26963 second address: B26967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26967 second address: B2696D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2696D second address: B2698E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA3B8E71770h 0x00000008 jne 00007FA3B8E71766h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B266CD second address: B266D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B274E7 second address: B2757C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA3B8E71770h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c add esi, 2EFE61D8h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FA3B8E71768h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e call 00007FA3B8E7176Bh 0x00000033 pop esi 0x00000034 mov esi, dword ptr [ebp+122D3B94h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FA3B8E71768h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 cmc 0x00000057 xchg eax, ebx 0x00000058 push ebx 0x00000059 push edx 0x0000005a push edi 0x0000005b pop edi 0x0000005c pop edx 0x0000005d pop ebx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FA3B8E71777h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2757C second address: B27582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27582 second address: B27586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CC02 second address: B2CC72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FA3B88AB018h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D1D03h], ebx 0x0000002a push 00000000h 0x0000002c jmp 00007FA3B88AB01Ch 0x00000031 push 00000000h 0x00000033 mov edi, dword ptr [ebp+122D37BEh] 0x00000039 xchg eax, esi 0x0000003a push ecx 0x0000003b jmp 00007FA3B88AB01Ch 0x00000040 pop ecx 0x00000041 push eax 0x00000042 pushad 0x00000043 je 00007FA3B88AB021h 0x00000049 jmp 00007FA3B88AB01Bh 0x0000004e push eax 0x0000004f push edx 0x00000050 jg 00007FA3B88AB016h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CC72 second address: B2CC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE40 second address: B2FE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE44 second address: B2FE51 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE51 second address: B2FE55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE55 second address: B2FE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE59 second address: B2FEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FA3B88AB018h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 cld 0x00000023 push 00000000h 0x00000025 mov edi, dword ptr [ebp+122D39DCh] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FA3B88AB018h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr [ebp+12457A4Ch], eax 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 jmp 00007FA3B88AB01Fh 0x00000056 push eax 0x00000057 pop eax 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FEC9 second address: B2FED3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA3B8E7176Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31163 second address: B31167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31167 second address: B3116B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3116B second address: B31171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31171 second address: B31182 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FA3B8E71766h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31182 second address: B31188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DE0C second address: B2DE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA3B8E7176Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DEB9 second address: B2DEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jbe 00007FA3B88AB02Eh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B332AF second address: B33316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FA3B8E71768h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jg 00007FA3B8E71766h 0x0000002a push 00000000h 0x0000002c xor bl, FFFFFFB4h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007FA3B8E71768h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d jmp 00007FA3B8E7176Bh 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33316 second address: B3331C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F0AD second address: B2F0B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA3B8E71766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33444 second address: B334FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB023h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, 4F0619DFh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jmp 00007FA3B88AB027h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007FA3B88AB018h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d stc 0x0000003e mov eax, dword ptr [ebp+122D03B1h] 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FA3B88AB018h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 0000001Ah 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e mov bx, dx 0x00000061 cmc 0x00000062 mov edi, dword ptr [ebp+12484F77h] 0x00000068 push FFFFFFFFh 0x0000006a jnl 00007FA3B88AB01Ch 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FA3B88AB022h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B38110 second address: B38126 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA3B8E71768h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B38126 second address: B381AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FA3B88AB018h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 call 00007FA3B88AB01Dh 0x0000002a mov edi, 44A7ED04h 0x0000002f pop edi 0x00000030 push 00000000h 0x00000032 mov bl, al 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1E49h], edi 0x0000003c xchg eax, esi 0x0000003d jne 00007FA3B88AB02Bh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FA3B88AB01Ch 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34477 second address: B344F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 add ebx, dword ptr [ebp+122D1E03h] 0x0000000f push dword ptr fs:[00000000h] 0x00000016 jmp 00007FA3B8E71775h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 mov edi, dword ptr [ebp+122D2D0Ch] 0x00000028 mov edi, dword ptr [ebp+122D2CD5h] 0x0000002e mov eax, dword ptr [ebp+122D005Dh] 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FA3B8E71768h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e mov dword ptr [ebp+12453D15h], esi 0x00000054 push FFFFFFFFh 0x00000056 mov bx, dx 0x00000059 nop 0x0000005a jmp 00007FA3B8E7176Ch 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B344F7 second address: B34528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB029h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA3B88AB021h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34528 second address: B3452C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A10C second address: B3A110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B354B5 second address: B3552A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA3B8E71773h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FA3B8E71768h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 cmc 0x0000002a push dword ptr fs:[00000000h] 0x00000031 xor edi, dword ptr [ebp+122D3958h] 0x00000037 mov dword ptr [ebp+122D2D41h], eax 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 cmc 0x00000045 mov eax, dword ptr [ebp+122D0399h] 0x0000004b movsx ebx, cx 0x0000004e mov dword ptr [ebp+122D2837h], ebx 0x00000054 push FFFFFFFFh 0x00000056 sub bh, 0000004Eh 0x00000059 nop 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d jnl 00007FA3B8E71766h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3552A second address: B3552E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3552E second address: B35537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35537 second address: B35544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37386 second address: B3738C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C092 second address: B3C09C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA3B88AB016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3738C second address: B37390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C847 second address: B3C84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C84B second address: B3C85D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FA3B8E71766h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C85D second address: B3C867 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C867 second address: B3C86D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3C86D second address: B3C871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FD20 second address: B3FD2E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FD2E second address: B3FD32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DCE2 second address: B4DCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA3B8E71766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D85B second address: B4D86D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FA3B88AB016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D86D second address: B4D882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E71771h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D882 second address: B4D89C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA3B88AB016h 0x00000008 jmp 00007FA3B88AB01Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25CB7 second address: B25CD2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FA3B8E7176Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57306 second address: B5730F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5730F second address: B5731E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ecx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5731E second address: B57356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push ebx 0x0000000c jmp 00007FA3B88AB021h 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007FA3B88AB023h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57356 second address: B5735F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57405 second address: B5740B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5740B second address: B5740F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5760A second address: B57624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB025h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD5D6 second address: ADD5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD5DC second address: ADD5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD5E1 second address: ADD616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E7176Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FA3B8E7176Eh 0x00000010 jmp 00007FA3B8E71771h 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B942 second address: B5B948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B948 second address: B5B954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA3B8E71766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B954 second address: B5B95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B95D second address: B5B967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA3B8E71766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B967 second address: B5B96F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5B96F second address: B5B979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FA3B8E71766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BC34 second address: B5BC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60664 second address: B60677 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA3B8E71766h 0x00000008 jg 00007FA3B8E71766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60937 second address: B6097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA3B88AB022h 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FA3B88AB01Dh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 jnp 00007FA3B88AB01Ch 0x0000001d jno 00007FA3B88AB016h 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 jns 00007FA3B88AB01Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B611C7 second address: B611CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B611CC second address: B611D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B611D2 second address: B611EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E71774h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61621 second address: B61644 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA3B88AB018h 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 jmp 00007FA3B88AB01Fh 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67FBF second address: B67FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FA3B8E7176Dh 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA3B8E71770h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B285E1 second address: B285E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B285E6 second address: B2863C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnl 00007FA3B8E7176Ch 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D2C06h], ebx 0x00000015 lea eax, dword ptr [ebp+1248E395h] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FA3B8E71768h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FA3B8E7176Dh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28725 second address: B28729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28729 second address: B2872D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28D6E second address: B28D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28D72 second address: B28D98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3B8E71774h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FA3B8E71768h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28ECC second address: B28ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28ED0 second address: B28EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28EE1 second address: B28EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B88AB01Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28EEF second address: B28F07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E7176Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29014 second address: B2901A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2901A second address: B2901F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29147 second address: B2914B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B298B3 second address: B298B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B298B7 second address: B2992F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FA3B88AB025h 0x0000000c nop 0x0000000d mov dword ptr [ebp+1248A16Dh], ebx 0x00000013 push edx 0x00000014 mov dword ptr [ebp+122D2D6Dh], edx 0x0000001a pop ecx 0x0000001b lea eax, dword ptr [ebp+1248E395h] 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007FA3B88AB018h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov ecx, dword ptr [ebp+122D3763h] 0x00000041 nop 0x00000042 pushad 0x00000043 jne 00007FA3B88AB018h 0x00000049 pushad 0x0000004a pushad 0x0000004b popad 0x0000004c jmp 00007FA3B88AB01Ch 0x00000051 popad 0x00000052 popad 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2992F second address: B29934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29934 second address: B076BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add ecx, dword ptr [ebp+122D26E1h] 0x00000011 call dword ptr [ebp+122D25AAh] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B076BF second address: B07701 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA3B8E71766h 0x00000008 jnp 00007FA3B8E71766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FA3B8E71773h 0x00000016 pop eax 0x00000017 push edx 0x00000018 jns 00007FA3B8E71766h 0x0000001e push esi 0x0000001f pop esi 0x00000020 pop edx 0x00000021 jmp 00007FA3B8E7176Dh 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push esi 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6829E second address: B682A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B682A2 second address: B682BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E71776h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E2FF second address: B6E305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E6C9 second address: B6E6E8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA3B8E7177Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E6E8 second address: B6E705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB01Eh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E705 second address: B6E723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E71778h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75772 second address: B75777 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78446 second address: B7844C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7844C second address: B78456 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA3B88AB016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78456 second address: B78462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78462 second address: B7846A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B785C7 second address: B785E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA3B8E71766h 0x0000000a popad 0x0000000b jmp 00007FA3B8E71771h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B785E7 second address: B785F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78769 second address: B7876D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7876D second address: B787B0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jg 00007FA3B88AB016h 0x00000013 jmp 00007FA3B88AB01Ch 0x00000018 jp 00007FA3B88AB016h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007FA3B88AB01Fh 0x00000027 pop eax 0x00000028 push eax 0x00000029 push edx 0x0000002a je 00007FA3B88AB016h 0x00000030 push edi 0x00000031 pop edi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C9B7 second address: B7C9C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jbe 00007FA3B8E7176Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C9C6 second address: B7C9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FA3B88AB03Bh 0x0000000b jc 00007FA3B88AB022h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C9D9 second address: B7C9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C388 second address: B7C39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB020h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C39D second address: B7C3A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C3A3 second address: B7C3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B823BC second address: B823C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80E80 second address: B80E93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jng 00007FA3B88AB016h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81046 second address: B8104A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8104A second address: B8104E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8104E second address: B81054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81054 second address: B81060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81060 second address: B81064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8148C second address: B814C0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA3B88AB022h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA3B88AB021h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814C0 second address: B814C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814C4 second address: B814D0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA3B88AB016h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814D0 second address: B814D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B814D8 second address: B814DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B292B5 second address: B292BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B862F8 second address: B862FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8644F second address: B8645F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B865A6 second address: B865DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB01Eh 0x00000009 jp 00007FA3B88AB016h 0x0000000f popad 0x00000010 push ebx 0x00000011 jmp 00007FA3B88AB029h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B865DA second address: B8660D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E71775h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FA3B8E71766h 0x0000000f jmp 00007FA3B8E71774h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C329 second address: B8C33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnc 00007FA3B88AB01Ch 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C496 second address: B8C49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C49E second address: B8C4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA3B88AB016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D6C6 second address: B8D6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D6CD second address: B8D6D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8DF46 second address: B8DF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FA3B8E71766h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f jmp 00007FA3B8E71774h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA3B8E71772h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8DF7D second address: B8DF81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9350F second address: B93527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E71770h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B93527 second address: B93533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA3B88AB016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B93533 second address: B93543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007FA3B8E71766h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B93543 second address: B93552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FA3B88AB016h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B97328 second address: B9732C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9732C second address: B9734E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB020h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007FA3B88AB01Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96450 second address: B96454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96454 second address: B96465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007FA3B88AB016h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96465 second address: B964AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a jmp 00007FA3B8E71777h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA3B8E71775h 0x00000017 jmp 00007FA3B8E7176Eh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B965FA second address: B96610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA3B88AB01Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96610 second address: B9662B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA3B8E7176Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FA3B8E71766h 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jnc 00007FA3B8E71766h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B967BA second address: B967E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FA3B88AB024h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA3B88AB020h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B967E6 second address: B967EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96C39 second address: B96C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FA3B88AB01Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96C48 second address: B96C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96C4C second address: B96C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96C51 second address: B96C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA3B8E7176Dh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FA3B8E71766h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96C71 second address: B96C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96F17 second address: B96F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9706D second address: B9709D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA3B88AB028h 0x0000000c jmp 00007FA3B88AB021h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E7E6 second address: B9E7F5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA3B8E71766h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E7F5 second address: B9E800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA3B88AB016h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E800 second address: B9E806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E806 second address: B9E80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E80A second address: B9E814 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA3B8E71766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E989 second address: B9E98E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E98E second address: B9E9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E71777h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9EF75 second address: B9EF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F11B second address: B9F12A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E7176Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F12A second address: B9F14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA3B88AB027h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9F679 second address: B9F68A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA3B8E7176Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E39D second address: B9E3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E3A3 second address: B9E3A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA459E second address: BA45B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB026h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA45B8 second address: BA45C2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA3B8E71766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5C89 second address: BA5CA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FA3B88AB016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007FA3B88AB01Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CA7 second address: BA5CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA3B8E71771h 0x0000000a jno 00007FA3B8E7176Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jmp 00007FA3B8E7176Bh 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CDB second address: BA5CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA3B88AB01Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5CEB second address: BA5CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8B2E second address: BA8B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7414 second address: BB742F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FA3B8E71772h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DC6 second address: BB9DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DCA second address: BB9DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DCE second address: BB9DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DD4 second address: BB9DD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9DD9 second address: BB9DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC377B second address: BC3780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC35FE second address: BC3604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3604 second address: BC360C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAC75 second address: BCAC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD251D second address: BD2521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E55 second address: BD0E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA3B88AB016h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007FA3B88AB022h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ebx 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FA3B88AB016h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E82 second address: BD0E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007FA3B8E7176Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FBD second address: BD0FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FC2 second address: BD0FF0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA3B8E7176Eh 0x00000008 jne 00007FA3B8E71766h 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FA3B8E71777h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FF0 second address: BD0FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FF6 second address: BD0FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0FFA second address: BD1021 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA3B88AB016h 0x00000008 jmp 00007FA3B88AB026h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD185B second address: BD1861 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6BBC second address: BD6BF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FA3B88AB024h 0x00000008 pop ecx 0x00000009 jmp 00007FA3B88AB01Fh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop eax 0x00000016 jno 00007FA3B88AB018h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6BF3 second address: BD6C1D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA3B8E7177Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FA3B8E71776h 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007FA3B8E71766h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6C1D second address: BD6C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2594 second address: AE25D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA3B8E7176Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA3B8E71774h 0x00000016 jmp 00007FA3B8E71775h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE25D7 second address: AE25F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FA3B88AB023h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADA08B second address: ADA091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2236 second address: BE2249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FA3B88AB016h 0x0000000d jnl 00007FA3B88AB016h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8F6E second address: BF8F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E7176Ch 0x00000009 popad 0x0000000a pop edi 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF836E second address: BF8378 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA3B88AB016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF87D2 second address: BF87D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF87D8 second address: BF87DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF87DC second address: BF87E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF87E8 second address: BF87FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B88AB021h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF87FD second address: BF8803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF896B second address: BF8982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA3B88AB021h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8AFE second address: BF8B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FA3B8E7176Ch 0x0000000c jc 00007FA3B8E71766h 0x00000012 jl 00007FA3B8E7177Ah 0x00000018 jmp 00007FA3B8E7176Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8C8F second address: BF8CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA3B88AB027h 0x0000000a jmp 00007FA3B88AB01Fh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA3B88AB026h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8CC2 second address: BF8CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00180 second address: C001A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FA3B88AB016h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FA3B88AB025h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001A9 second address: C001B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA3B8E71766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02A7E second address: C02A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05A7A second address: C05A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC005 second address: BFC009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC009 second address: BFC012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC197 second address: BFC1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA3B88AB016h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC1A6 second address: BFC1AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD300 second address: BFD304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD304 second address: BFD31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA3B8E7176Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD31B second address: BFD321 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD321 second address: BFD327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD327 second address: BFD33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA3B88AB01Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD33B second address: BFD33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B223FC second address: B22401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22401 second address: B22407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 96DC71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 96B14A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B3FD76 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2876C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAA3E5 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5660000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF0651 rdtsc

0_2_00AF0651

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B03546 sidt fword ptr [esp-02h]

0_2_00B03546

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1436

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF0651 rdtsc

0_2_00AF0651

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0096B970 LdrInitializeThunk,

0_2_0096B970

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: hcMProgram Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	271 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561484
Start date and time:	2024-11-23 14:46:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.498844095431356
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'805'248 bytes
MD5:	2636521bdc04a44fcfa2f00957445a04
SHA1:	410cdacf1d5343680913c86746b908f8e2f4fe86
SHA256:	6ec188e021ed6d5a7dbe083969e72adb44dc23165cad269113c0bd0a726b5187
SHA512:	2f5f4898dd3adb44deda74c73f1b403ca04d2df81d169b3d563647694854666e7ffbe6423f0e15a906b688f3bc1c7b8b03ed344e35055bf2d8abe1d5689ad058
SSDEEP:	49152:tVCEKAhyLj6Kdq2EP1bSIcIaHnNAkJMcEp:tVCohyLxdwUIcrnNPSzp
TLSH:	78D52AB3B60976CFD48E2378942BCD426D6D03B9472448E3AC6D74BA7D67CC116B6C28
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....V8+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA3B86D7F0Ah
shrd dword ptr [edx], ebp, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA3B86D9F05h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	b35836cd4cf892ce73f9ce0aa1ffa8bb	False	0.9340277777777778	data	7.804898343067434	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
idwitinv	0xa000	0x2a8000	0x2a6c00	2d7162cfbf06c8d861ed63031ec3e106	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mjfbzujg	0x2b2000	0x2000	0x600	81876bb99915c1c32a2991d157059102	False	0.5709635416666666	data	4.9988768161422525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b4000	0x4000	0x2200	0e7db6bd65dc2f504c970ba33d90074d	False	0.07318474264705882	DOS executable (COM)	0.836653898970713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	08:47:04
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x960000
File size:	2'805'248 bytes
MD5 hash:	2636521BDC04A44FCFA2F00957445A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	22%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	3

Executed Functions

Function 00AF0651 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00AF0686

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9ad46f7710bca12ac97c3e9895372d36d8262e104c53e508c3396485b8119d07
Instruction ID: 8ecc6f1f0e2431c4855fad8b1168cb6047c3cd9e15a1a194c4fdfad16f60835b
Opcode Fuzzy Hash: 9ad46f7710bca12ac97c3e9895372d36d8262e104c53e508c3396485b8119d07
Instruction Fuzzy Hash: CCD017B618801D7DE6909F90DA59EBEBB69EBD1331F304029F909D6483D6E01D194624

Function 0096B970 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcdac02a810a55ebe98bb1d9eb261dc17efb9f2eec347b7b8c70f17e303ab64
Instruction ID: 78dcefd42bb7dd4890fb344be9e73bc582322a902d6beec12fcd1e435b8c3369
Opcode Fuzzy Hash: 3bcdac02a810a55ebe98bb1d9eb261dc17efb9f2eec347b7b8c70f17e303ab64
Instruction Fuzzy Hash: 8131E373D509218FD7258F688910369B3A1EB44B54F1A4974CC8AEB7AAF3396DD087C4

Function 00BDA027 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00BDA465
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00BDA4F9

Strings

V, xrefs: 00BDA4D6

Memory Dump Source

Source File: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: V
API String ID: 2087232378-1342839628
Opcode ID: 77a57d36ba21b35be0dbf7d569f2fa679419e1ebb6726aa100d184890fd7582d
Instruction ID: dec588f6f38ef19508657c238c773516eb610f023761c2527ba0f58505886437
Opcode Fuzzy Hash: 77a57d36ba21b35be0dbf7d569f2fa679419e1ebb6726aa100d184890fd7582d
Instruction Fuzzy Hash: A4417B7060420E9FEB119F28DC88BAF77E4EB18314F140065A909D7B91E7BA9C54CB5A

Function 00AFBF25 Relevance: 3.0, APIs: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00AFCFA0
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00AFCFC7

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a03ea36c3eaa3bbc6ab644e460decc6bed15dcd04ab8346116ff39bc553857a5
Instruction ID: 3bc49f0de1fa98906e067906592dbddc65b0fcefe9f81484c18c4b98c2f9f966
Opcode Fuzzy Hash: a03ea36c3eaa3bbc6ab644e460decc6bed15dcd04ab8346116ff39bc553857a5
Instruction Fuzzy Hash: 66114C7200424F9FEF10CF60C988ADF7BA9EB05314F010226FA8185912D7B64D64CF59

Function 00AF0660 Relevance: 1.6, APIs: 1, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00AF0686

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c619a121d109aacffd0d01f66579aa3839226368b9c32f3535b64f76d2e70679
Instruction ID: bc4496fd2f40210644941802a3858ad2adf1fa2c6ec389de39f5b99da2c5a6ae
Opcode Fuzzy Hash: c619a121d109aacffd0d01f66579aa3839226368b9c32f3535b64f76d2e70679
Instruction Fuzzy Hash: D8310AB718C2486EE3019BE16E51FBA7B78EBC3330F3144A6F142D6443D1E01D499A35

Function 00AF0983 Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,8970D800,00000003), ref: 00AF09CE

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ec5083874401c3b68da3c8f2d18b28ae7f8baf0dd66b1fad8e06b92c7e14fd5e
Instruction ID: ab01e49f0c7e38723c14902f051b37c63ad27223667b1a75cfead9156c74e8e1
Opcode Fuzzy Hash: ec5083874401c3b68da3c8f2d18b28ae7f8baf0dd66b1fad8e06b92c7e14fd5e
Instruction Fuzzy Hash: CC11B2B260421E6EF711DEA49E64FFF73A8DB85770F30843AF901C6583D2A20C598674

Function 05500D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05500DCD

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: ea409859cde07f3c7fbfd13f443a43da41908736fe284836209f2dbfa60cbeaf
Instruction ID: 0ea175dd420dcaa41b38eb7e0632fb8c636d2c9ddd834573de5fca6c90cf93b2
Opcode Fuzzy Hash: ea409859cde07f3c7fbfd13f443a43da41908736fe284836209f2dbfa60cbeaf
Instruction Fuzzy Hash: 732137B6C002199FCB10CF99D884BDEFBF5FF89310F14851AD909AB254C734A541CBA4

Function 00AF080B Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00AF0855

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 56612ef55140fe110a1162ab2b630243e1c2707b239a91821e20c6b0650d0ea8
Instruction ID: 5bbba1ddef7715d1279f6b32cae37d0e0331716f5e69c76e19bb60e647988fe7
Opcode Fuzzy Hash: 56612ef55140fe110a1162ab2b630243e1c2707b239a91821e20c6b0650d0ea8
Instruction Fuzzy Hash: 390145B354D21D7DFB10AAE04E91EFF7B68E791770F30802AFA45D3483C290180986B4

Function 05500D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05500DCD

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: b5dbeb86a902eac07c1f44e97ff54fdeae10266d8fa49fb3acb7a6c3c5a467bf
Instruction ID: bd16e958cf1803ebf11e2ee37077f2ee02e38ab132c6d6bdb7227d17417ffbb8
Opcode Fuzzy Hash: b5dbeb86a902eac07c1f44e97ff54fdeae10266d8fa49fb3acb7a6c3c5a467bf
Instruction Fuzzy Hash: 782134B6C002189FCB10CF99D888BDEFBF5FB88310F14811AD809AB254C734A541CBA4

Function 05501510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05501580

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 901448b5e5657c7c6ae5134db12c0fe263ccfb07a5f6cee5999b02b6afacca80
Instruction ID: d8223ae7b9f47ccd6ca277c816327216ea5abe177a22dbf1bebcc5d33512b7b5
Opcode Fuzzy Hash: 901448b5e5657c7c6ae5134db12c0fe263ccfb07a5f6cee5999b02b6afacca80
Instruction Fuzzy Hash: F011E4B5D006499FDB10CF9AC984BDEFBF4FB48320F108429E559A7250D778A644CFA5

Function 05501509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05501580

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0aad091c7df1cc9b83f52f3d800ed55984d3a8db3e7c227319f6a56fb8380e86
Instruction ID: ad9c2ba1b12b3daca2bf67da592570cabf49dd5b5f1c6ad2512169bcc381a52e
Opcode Fuzzy Hash: 0aad091c7df1cc9b83f52f3d800ed55984d3a8db3e7c227319f6a56fb8380e86
Instruction Fuzzy Hash: 1F11F2B59006098FDB10CFAAC584BDEBBF4BB48310F10842AE559A7250D778A644CFA1

Function 00AF09DA Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,8970D800,00000003), ref: 00AF09CE

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e02f940a00c3753710b32660f0126e797089ee0c58009d4b63ea14479407e82c
Instruction ID: 22b91412bb702c73dae8c5d84bac962e231cbe2402264a9389f0a3dce0060863
Opcode Fuzzy Hash: e02f940a00c3753710b32660f0126e797089ee0c58009d4b63ea14479407e82c
Instruction Fuzzy Hash: 4601F27160021FAEEB109FA88964FFF73A4DB457A4F30443AFA01D7943D2A60C548728

Function 05501301 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05501367

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: bf1f89eb99367392dc21011925c56ec7c1255c5ecb205a1e74df39cc9f3c67a9
Instruction ID: f6f3373cf768af5f5742ce72d202389655386724fe397786cd8fe3e6a0bdc18d
Opcode Fuzzy Hash: bf1f89eb99367392dc21011925c56ec7c1255c5ecb205a1e74df39cc9f3c67a9
Instruction Fuzzy Hash: 011113B18002498FDB10DF9AC985BDEFBF8EF48324F24842AD518A3250D778A544CFA5

Function 00AF095A Relevance: 1.5, APIs: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,8970D800,00000003), ref: 00AF09CE

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6e32e1c0a107eb3e327ccef6c33dc5035f075437fce0fbc51d24d278ca9c2e4e
Instruction ID: 275192da013a40f5dcb4062543485bb442458290e72886ed3f16db10c27896ee
Opcode Fuzzy Hash: 6e32e1c0a107eb3e327ccef6c33dc5035f075437fce0fbc51d24d278ca9c2e4e
Instruction Fuzzy Hash: 9A01D27060420FDFDB209FA4C9A5AEF73F1EF19754F204429EA42DBE52E2B24C548B18

Function 05501308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05501367

Memory Dump Source

Source File: 00000000.00000002.2263416185.0000000005500000.00000040.00000800.00020000.00000000.sdmp, Offset: 05500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5500000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 20c4450f7da67e4c6b25c417d29e559ceedef24550a0104c475d2e09abf79f8d
Instruction ID: 79c6ec43902fc8acbe2351ce9506c9c93a8a5cb8c299501b8d330af8d7a05c5a
Opcode Fuzzy Hash: 20c4450f7da67e4c6b25c417d29e559ceedef24550a0104c475d2e09abf79f8d
Instruction Fuzzy Hash: D91125B18002498FDB10CF9AC944BDEFBF8EF48324F10841AD518A3250C778A544CFA5

Function 00AF061F Relevance: 1.5, APIs: 1, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00AF0686

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c2b604f328035b07ec1afd819cb42dc3856949dc442de9567eb1906cd5e5c7b9
Instruction ID: d54b998f20c8ac1564e50914283fb9ba13d217f7c2be84abd6e9e90d1ac7a68d
Opcode Fuzzy Hash: c2b604f328035b07ec1afd819cb42dc3856949dc442de9567eb1906cd5e5c7b9
Instruction Fuzzy Hash: 1BF0F4310893885EE3124BB08972BAA3F548F52701F199485F3818B8D3C2C44D019754

Function 00AF0824 Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00AF0855

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b1a8c040c7a3433bac773436aeb4d43ac8106d03ba4731355f00407f492e795e
Instruction ID: e3325425a70f801c49f5c0e24372ec2cb8e6881fa2527e56aae645e09a87e8a8
Opcode Fuzzy Hash: b1a8c040c7a3433bac773436aeb4d43ac8106d03ba4731355f00407f492e795e
Instruction Fuzzy Hash: 74E09BBB64D1597CBA14A5E11F51DBF6B5CD5C5371F30C036F547D6483D281480901B4

Function 00AF060E Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e3b4f1b737f74f4091f17fac8464e753807b17b438bf77f54dd996121bea5faf
Instruction ID: b4d78395efc796c3ae0d3a0d3c5b8fed76139ed22d3362bf3eceaf439601139e
Opcode Fuzzy Hash: e3b4f1b737f74f4091f17fac8464e753807b17b438bf77f54dd996121bea5faf
Instruction Fuzzy Hash: 72F024BA58411C9ECE90DF94DA28FBDBB71FBD23A1FB00419F5449B143E2E00E26D655

Function 00AF09BF Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8970D800,00000003), ref: 00AF09CE

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d97c380f60e5b4646b71c3e08d950baa8912289542ee7c81b4d49b5b7bcd625
Instruction ID: 4ea2ab7a3898d1134cedf237ac61be1edca1c13ab9a7b379b13bde97e35f833f
Opcode Fuzzy Hash: 6d97c380f60e5b4646b71c3e08d950baa8912289542ee7c81b4d49b5b7bcd625
Instruction Fuzzy Hash: D3F0C27160020F9FDB10DFA8C965BFF73E1DB08764F30443AEA02D7982C2620C548B18

Function 00AFA2DA Relevance: 1.5, APIs: 1, Instructions: 13libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00AFA2E4

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 261971ac5cbb74dac2736049434cf36413ffb0d21c43aae74f8e9252a95c34a0
Instruction ID: 83dfd2635609ebae58ceab059708fc41e4ff544bfe9d01f3e2c50c26296d0ac2
Opcode Fuzzy Hash: 261971ac5cbb74dac2736049434cf36413ffb0d21c43aae74f8e9252a95c34a0
Instruction Fuzzy Hash: 93D092B041CA09DBD3412F9198888BDBAF0EE693A0F12091DBAD6C2900D7354040DF03

Function 0096E8C6 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0096EC78

Memory Dump Source

Source File: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 82714f53f032ad47b7bc22122b4f5aada691d4448977d8a048660348112679e1
Instruction ID: ba8440c9a9d4b5f89aa5ff59cfc17e5aa2197d45eecbb677ae7eb7087290693e
Opcode Fuzzy Hash: 82714f53f032ad47b7bc22122b4f5aada691d4448977d8a048660348112679e1
Instruction Fuzzy Hash: 25F064B650D700EFD748AF36928816EBBE0EFD4B10F25882DE0C987250E6354C85EB1B

Function 0096EF93 Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0096EF95

Memory Dump Source

Source File: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 403f4003a599f185268a9c2e02597ba93faa3a48b6004f33bc8ddb666ce56dc9
Instruction ID: efd83c73500e4c770afe5142e04fbe4ef6c5fa6b4aa6d835ac105d0d934cb3c8
Opcode Fuzzy Hash: 403f4003a599f185268a9c2e02597ba93faa3a48b6004f33bc8ddb666ce56dc9
Instruction Fuzzy Hash: C5E086B5408549CBC7042F34891925D7AB0EF14321F240728F87386AC0C7354C50C70A

Non-executed Functions

Function 00BDA5BE Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

W.F, xrefs: 00BDAEFC

Memory Dump Source

Source File: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: W.F
API String ID: 0-1349702810
Opcode ID: 029c6e6221b814541fa77a6cf69e9af3ca9fd3107b22d8eff7dd103928e1eb17
Instruction ID: d07826cef51b2be3f6382e5691d7a28e6cf3795a1358d37183f42a7792d76563
Opcode Fuzzy Hash: 029c6e6221b814541fa77a6cf69e9af3ca9fd3107b22d8eff7dd103928e1eb17
Instruction Fuzzy Hash: 1932C0365056569BDF258F25C8653A9FBE1EB62720F2C42DBD8818B752F329DC02C783

Function 0096DDBC Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0096DFFE

Memory Dump Source

Source File: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 3e8bebef6d41e2deeb2dfb305ac358e10b8b1730c1e7cad38a738978b8f5cf33
Instruction ID: 06ef29ae7c16087916d8cb7080635ff5711bc4699b1ca51bdf6ed1f92fbb53b3
Opcode Fuzzy Hash: 3e8bebef6d41e2deeb2dfb305ac358e10b8b1730c1e7cad38a738978b8f5cf33
Instruction Fuzzy Hash: 668114B6A0820E9FDB11CF25C5401EF7BE5FB9A320F24442AE84287A42D3F25D25DF59

Function 00B051BC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

8Jy~, xrefs: 00B0522A

Memory Dump Source

Source File: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: 8Jy~
API String ID: 0-546740672
Opcode ID: c067dbf0e25ae976bdadbea4d7880e4fa260d872551334abe223a4a8a1f442f7
Instruction ID: e0d4d617b2e11cb741eb562c632c0314bda638944352924fcc4ef7632969a143
Opcode Fuzzy Hash: c067dbf0e25ae976bdadbea4d7880e4fa260d872551334abe223a4a8a1f442f7
Instruction Fuzzy Hash: E04119F650C300AFE304AE19DD816BBBBE9FBC8720F25892DF6C5C3604D63559058667

Function 00B051A8 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

8Jy~, xrefs: 00B0522A

Memory Dump Source

Source File: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: 8Jy~
API String ID: 0-546740672
Opcode ID: 66dca83568570ec627b6d995156bb407b18e15ae0daf8437d5fe8233e1a25f3f
Instruction ID: 95abb50c5bc48ecdc271d4cd4703888424564245aeb67484628aade2f02da553
Opcode Fuzzy Hash: 66dca83568570ec627b6d995156bb407b18e15ae0daf8437d5fe8233e1a25f3f
Instruction Fuzzy Hash: 92412AF650C300AFE304AE19ED816BBBBE9EFC8720F25882DF6C5C3600D23558048A67

Function 00B051CF Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

8Jy~, xrefs: 00B0522A

Memory Dump Source

Source File: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: 8Jy~
API String ID: 0-546740672
Opcode ID: 13b3e969fc7ffd83c948f3e02e8ebcaf4f5057500274441b283b705b5bf5eb3f
Instruction ID: fc1835069307e17e9a14a90f42946e2742157291c20875e45333f57bc6cb5db1
Opcode Fuzzy Hash: 13b3e969fc7ffd83c948f3e02e8ebcaf4f5057500274441b283b705b5bf5eb3f
Instruction Fuzzy Hash: 28412BB250C300AFE304AE19DD816BBBBE5EFD4710F15882DF6C5C3644D635580586A7

Function 00B051FB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

8Jy~, xrefs: 00B0522A

Memory Dump Source

Source File: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID: 8Jy~
API String ID: 0-546740672
Opcode ID: cf3498ae82a9d2951950ff6794c6b17d62734f4f8f23a62e7afad99b3f76a874
Instruction ID: 0eb2028139d44976ca489e869037190f5a771acf901a24fb705a34244a73de43
Opcode Fuzzy Hash: cf3498ae82a9d2951950ff6794c6b17d62734f4f8f23a62e7afad99b3f76a874
Instruction Fuzzy Hash: F14116B250C310AFE305AF29DC816BABBE5FF88710F15892EE6C4C7650D63558148B97

Function 00AEE8C9 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9448f145daf70a93aca7a6768fe01e8e8cae7a0b64818e3327c29b6558b714e
Instruction ID: 062b1e7327907cc1c8a25f83484928a3e77557498bc4905530bc4c8f2bcee9c5
Opcode Fuzzy Hash: a9448f145daf70a93aca7a6768fe01e8e8cae7a0b64818e3327c29b6558b714e
Instruction Fuzzy Hash: A35121B365C740DFD304AA2AEC8567AFAF9FB85360F66443DE1C286645FA7048419783

Function 00AEE982 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc97adbbc454201d554019098644a86afc0af63a7bc1580f370276615ece2701
Instruction ID: 3a430e7d81d99bf16c0ce96ae106f317be595d394bde66a81c6a1c68246b6731
Opcode Fuzzy Hash: cc97adbbc454201d554019098644a86afc0af63a7bc1580f370276615ece2701
Instruction Fuzzy Hash: 24512FB365C780DFD304AA2AEC8567AFAF9FB84360F66443DE1C286645FA7008419682

Function 00B6FDAE Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c00b95a0c4b3165baf10c1763001689f4708a0e31b8d76736838c8fefe4721
Instruction ID: 310c0abfa13a15b940179cd0936babcb76ad974b8a01132fbb5178d1763ae6c5
Opcode Fuzzy Hash: 31c00b95a0c4b3165baf10c1763001689f4708a0e31b8d76736838c8fefe4721
Instruction Fuzzy Hash: BC4126F390C2009FE7056E29EC4167EBBE6EB94360F074A3DEAC483744E63658158687

Function 00B7CC42 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048f3fceab5d2789c6861002229a22cff3a07a2bc443a166387a717ca12fa3f6
Instruction ID: ab7003f230f34e121fd1d4b89388213fb9b8fc278fa62e9d04155351776dd786
Opcode Fuzzy Hash: 048f3fceab5d2789c6861002229a22cff3a07a2bc443a166387a717ca12fa3f6
Instruction Fuzzy Hash: A121BFB290D210DFD3412A25D88002EFFF5EF98300F73896EE9EEA6204D73018419B83

Function 00B03546 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2261296660.0000000000B02000.00000040.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.2260920510.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260954175.0000000000962000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2260982605.0000000000966000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261011512.000000000096A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261043605.0000000000976000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261151069.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261166055.0000000000AD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261184675.0000000000AEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261200961.0000000000AEC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261218121.0000000000AF5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261253039.0000000000AFD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261269990.0000000000B00000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261283546.0000000000B01000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261320955.0000000000B33000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261336088.0000000000B3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261349572.0000000000B3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261362816.0000000000B3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261381604.0000000000B4C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261394393.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261409706.0000000000B5D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261424198.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261436678.0000000000B66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261451073.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261464681.0000000000B71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261477639.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261492404.0000000000B81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261505043.0000000000B83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261519593.0000000000B8A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261576272.0000000000B8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261638758.0000000000B96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261663263.0000000000B98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261683645.0000000000BA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261705745.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261736581.0000000000BBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261763752.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261799888.0000000000BEE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2261815818.0000000000BEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000BFA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262006649.0000000000C02000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262172085.0000000000C12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2262195853.0000000000C14000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f6c6febed588bd6e0ee4a3dfd3c1e2c9f402f91dc5341c97da43030d02f288
Instruction ID: 3274f71bcb4aa4344636b33e48efd3fb47c3f9b135dee0e7f17b50597c875b99
Opcode Fuzzy Hash: 22f6c6febed588bd6e0ee4a3dfd3c1e2c9f402f91dc5341c97da43030d02f288
Instruction Fuzzy Hash: 47E0463A004101AAC700EF64D84999FFBF8FF29310F20D88AE884CB262C2358D51CB2A

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 6764, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 6764, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Function 00AF0651 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Windows Analysis Report
file.exe

Function 00BDA027 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 111
memoryCOMMON

Function 00AFBF25 Relevance: 3.0, APIs: 2, Instructions: 46
registryCOMMON

Function 00AF0660 Relevance: 1.6, APIs: 1, Instructions: 126
fileCOMMON

Function 00AF0983 Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Function 05500D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00AF080B Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Function 05500D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05501510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05501509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 00AF09DA Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Function 05501301 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 00AF095A Relevance: 1.5, APIs: 1, Instructions: 48
fileCOMMON

Function 05501308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00AF061F Relevance: 1.5, APIs: 1, Instructions: 41
fileCOMMON