Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562254
MD5:	d30bd6bc4ce8e63cd599e4d1b604c815
SHA1:	c79f06015669a06f56c7f3ce81e4b5f18c91d867
SHA256:	53705aeb862870ba7f20fcbe388077b9b47f049a6132ae4b3fe9a23208f5897f
Tags:	exeHealeruser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 716 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D30BD6BC4CE8E63CD599E4D1B604C815)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_011B6DCC CryptVerifySignatureA,

0_2_011B6DCC

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2254017111.0000000004840000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011595D5	0_2_011595D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B	0_2_0115516B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011595F0	0_2_011595F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01159606	0_2_01159606

Source: file.exe, 00000000.00000002.2387287169.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2229039941.0000000000FD6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeP

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2846720 > 1048576

Source: file.exe

Static PE information: Raw size of frqkrlxj is bigger than: 0x100000 < 0x2b1000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W;frqkrlxj:EW;fygxckij:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ba0c9 should be: 0x2c3c2c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: frqkrlxj
Source: file.exe	Static PE information: section name: fygxckij
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011595D5 push ebx; mov dword ptr [esp], edx	0_2_01159611
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011595D5 push 2529F9DFh; mov dword ptr [esp], ebp	0_2_0115968C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01159737 push ebp; mov dword ptr [esp], 7FFF7844h	0_2_01159754
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01159737 push ebx; mov dword ptr [esp], 77FDC6EBh	0_2_01159780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01159737 push eax; mov dword ptr [esp], ebp	0_2_011597C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A119 push esi; mov dword ptr [esp], 2966B134h	0_2_0115A1AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A119 push esi; mov dword ptr [esp], 2632CD26h	0_2_0115A1BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A119 push 685C1BB8h; mov dword ptr [esp], edx	0_2_0115A21F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDC0DC push ecx; mov dword ptr [esp], esp	0_2_00FDC0DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDC0DC push 107437FAh; mov dword ptr [esp], esi	0_2_00FDC0EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A12B push esi; mov dword ptr [esp], 2966B134h	0_2_0115A1AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A12B push esi; mov dword ptr [esp], 2632CD26h	0_2_0115A1BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115A12B push 685C1BB8h; mov dword ptr [esp], edx	0_2_0115A21F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123E16C push ebx; mov dword ptr [esp], esp	0_2_0123E1C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE20A9 push ebx; mov dword ptr [esp], edi	0_2_00FE20AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115C14C push ebp; ret	0_2_0115C15B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE3093 push 6AE1F7C2h; mov dword ptr [esp], edx	0_2_00FE30AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE3093 push 61E197A2h; mov dword ptr [esp], ebp	0_2_00FE30BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push 1C15ACE5h; mov dword ptr [esp], ebx	0_2_011551FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push ecx; mov dword ptr [esp], ebp	0_2_0115521E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push edx; mov dword ptr [esp], eax	0_2_0115524D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push 3E94A4E6h; mov dword ptr [esp], eax	0_2_01155274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push 5C9B4748h; mov dword ptr [esp], ecx	0_2_01155289
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push 1F569CA5h; mov dword ptr [esp], ebx	0_2_011552BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push ecx; mov dword ptr [esp], ebx	0_2_0115530B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push 533F9011h; mov dword ptr [esp], ebx	0_2_0115538C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push ecx; mov dword ptr [esp], edx	0_2_01155396
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push ecx; mov dword ptr [esp], ebp	0_2_011553F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push edx; mov dword ptr [esp], 71D04F01h	0_2_0115541A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push ebp; mov dword ptr [esp], eax	0_2_01155473
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115516B push edi; mov dword ptr [esp], ebx	0_2_011554AA

Source: file.exe

Static PE information: section name: entropy: 7.809790627438205

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE810 second address: FDE82C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE82C second address: FDE83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1131072E1Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A434 second address: 115A43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D5F6 second address: 114D5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D5FC second address: 114D61B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F11310835B5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D61B second address: 114D61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599E5 second address: 1159A0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835B8h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F11310835A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159A0B second address: 1159A22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 js 00007F1131072E35h 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F1131072E16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B74 second address: 1159B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BD84 second address: 115BD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BD88 second address: 115BD8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDFA second address: 115BEC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jl 00007F1131072E16h 0x00000010 pop edi 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 jg 00007F1131072E1Ch 0x0000001b mov esi, dword ptr [ebp+122D2EEDh] 0x00000021 mov dword ptr [ebp+122D1DD7h], esi 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F1131072E18h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D5D1Dh], edi 0x00000049 mov edx, dword ptr [ebp+122D3025h] 0x0000004f push E2281EAEh 0x00000054 push esi 0x00000055 pushad 0x00000056 jbe 00007F1131072E16h 0x0000005c jl 00007F1131072E16h 0x00000062 popad 0x00000063 pop esi 0x00000064 add dword ptr [esp], 1DD7E1D2h 0x0000006b sub dword ptr [ebp+122D2C65h], ecx 0x00000071 push 00000003h 0x00000073 mov ch, dl 0x00000075 push 00000000h 0x00000077 call 00007F1131072E20h 0x0000007c jmp 00007F1131072E27h 0x00000081 pop esi 0x00000082 push 00000003h 0x00000084 sub edx, 16DAD08Ch 0x0000008a push 6E3B112Eh 0x0000008f push eax 0x00000090 pushad 0x00000091 push eax 0x00000092 push edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BEC6 second address: 115BF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 add dword ptr [esp], 51C4EED2h 0x0000000f jmp 00007F11310835B3h 0x00000014 lea ebx, dword ptr [ebp+12451CDDh] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F11310835A8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 and esi, dword ptr [ebp+122D2C65h] 0x0000003a sbb edi, 50EABCBAh 0x00000040 mov dx, cx 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 jp 00007F11310835ACh 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BF63 second address: 115BF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BF69 second address: 115BFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edx, dword ptr [ebp+122D2EC9h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F11310835A8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov cx, ax 0x0000002d push 729DD2C7h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 pushad 0x00000036 popad 0x00000037 pop eax 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFA6 second address: 115BFAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFAB second address: 115BFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C0A1 second address: 115C0C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F1131072E16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C0C9 second address: 115C0CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C11D second address: 115C12F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F1131072E16h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C12F second address: 115C134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C134 second address: 115C139 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C139 second address: 115C17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F11310835A8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 sub dword ptr [ebp+122D1D79h], eax 0x0000002a push EDB7CB0Fh 0x0000002f push edx 0x00000030 pushad 0x00000031 jp 00007F11310835A6h 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C256 second address: 115C26D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C26D second address: 115C272 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11434C0 second address: 11434C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11434C4 second address: 11434DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F11310835AEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11434DE second address: 11434F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007F1131072E20h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C5F4 second address: 117C622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835ACh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jne 00007F11310835BBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C93D second address: 117C953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1131072E1Bh 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C953 second address: 117C95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F11310835A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FBD1 second address: 116FBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114BBE4 second address: 114BBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D1DB second address: 117D1E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D1E3 second address: 117D20C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F11310835B2h 0x00000009 jmp 00007F11310835B3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11821B9 second address: 11821BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11826E6 second address: 11826EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182854 second address: 1182867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11829AA second address: 11829E0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F11310835BEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F11310835B1h 0x00000013 jmp 00007F11310835ABh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114193C second address: 1141940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141940 second address: 1141952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F11310835A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141952 second address: 1141956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141956 second address: 114198C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F11310835A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F11310835ACh 0x00000010 jns 00007F11310835A6h 0x00000016 jnl 00007F11310835BAh 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114198C second address: 1141990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141990 second address: 11419A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d jg 00007F11310835A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11419A5 second address: 11419AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2E4 second address: 113E2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2F0 second address: 113E2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2F6 second address: 113E2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2FC second address: 113E306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1131072E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11878A5 second address: 11878AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11878AB second address: 11878AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11878AF second address: 11878C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835AFh 0x00000007 jno 00007F11310835A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11878C8 second address: 11878E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F1131072E23h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187FE4 second address: 1187FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187FEC second address: 1187FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E1Ch 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187FFF second address: 1188004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11882DA second address: 11882DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11882DE second address: 11882F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835B2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11882F6 second address: 118831D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1131072E22h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1131072E21h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B78D second address: 118B7BF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F11310835A8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F11310835B0h 0x00000013 jmp 00007F11310835AAh 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c pushad 0x0000001d jno 00007F11310835ACh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B7BF second address: 118B7D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jns 00007F1131072E16h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B7D2 second address: 118B7D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BDAB second address: 118BDB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C3A0 second address: 118C3A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C87E second address: 118C884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C95D second address: 118C961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C961 second address: 118C965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CFE6 second address: 118D00F instructions: 0x00000000 rdtsc 0x00000002 js 00007F11310835A8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F11310835B3h 0x00000013 js 00007F11310835ACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D00F second address: 118D076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, dword ptr [ebp+122D1C62h] 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F1131072E18h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov esi, dword ptr [ebp+122D1C66h] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F1131072E18h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D1C66h] 0x00000050 xchg eax, ebx 0x00000051 pushad 0x00000052 jo 00007F1131072E1Ch 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D076 second address: 118D07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D07E second address: 118D096 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1131072E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007F1131072E16h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DA0C second address: 118DA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F2DE second address: 118F2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F2E2 second address: 118F2EC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F11310835A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191F30 second address: 1191F36 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191F36 second address: 1191FA6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F11310835A8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sbb esi, 1B4EDBFBh 0x00000029 sub dword ptr [ebp+122D2572h], esi 0x0000002f push 00000000h 0x00000031 and si, 2411h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F11310835A8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 movzx edi, si 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jnc 00007F11310835A8h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191FA6 second address: 1191FC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1131072E1Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jc 00007F1131072E16h 0x00000017 jc 00007F1131072E16h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194DBB second address: 1194DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194DBF second address: 1194DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194EBF second address: 1194EC5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194EC5 second address: 1194ED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196D24 second address: 1196D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194ED9 second address: 1194EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197BEC second address: 1197BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196FEA second address: 1196FEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197BF0 second address: 1197BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196FEE second address: 1197003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F1131072E16h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197BF4 second address: 1197C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F11310835B0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C0D second address: 1197C58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 cmc 0x0000000a push 00000000h 0x0000000c call 00007F1131072E21h 0x00000011 push edx 0x00000012 jne 00007F1131072E16h 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007F1131072E18h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C58 second address: 1197C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C5C second address: 1197C6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C6F second address: 1197C7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F11310835A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199B94 second address: 1199B9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197E10 second address: 1197E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F11310835A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199B9F second address: 1199BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D5D58h], ecx 0x0000000d push 00000000h 0x0000000f sbb ebx, 5838A378h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F1131072E18h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 jnc 00007F1131072E1Eh 0x00000037 mov dword ptr [ebp+122D3F5Dh], ebx 0x0000003d xchg eax, esi 0x0000003e jmp 00007F1131072E1Ah 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197E1D second address: 1197E32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F11310835A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199D5C second address: 1199D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AC56 second address: 119ACCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F11310835AFh 0x00000010 popad 0x00000011 pop esi 0x00000012 nop 0x00000013 jo 00007F11310835A9h 0x00000019 push edx 0x0000001a cld 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e sub dword ptr [ebp+122D2CD5h], edx 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F11310835A8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 push eax 0x00000041 pushad 0x00000042 push edi 0x00000043 jmp 00007F11310835B1h 0x00000048 pop edi 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F11310835B2h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CDBC second address: 119CDE7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1131072E1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F1131072E26h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CDE7 second address: 119CE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 jmp 00007F11310835AFh 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F11310835A8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D3249h] 0x0000002e mov ebx, dword ptr [ebp+122D2FD9h] 0x00000034 push 00000000h 0x00000036 sbb di, 6B1Ah 0x0000003b push eax 0x0000003c pushad 0x0000003d jc 00007F11310835A8h 0x00000043 push esi 0x00000044 pop esi 0x00000045 pushad 0x00000046 push eax 0x00000047 pop eax 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED6A second address: 119ED7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1131072E1Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC60 second address: 119FC66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC66 second address: 119FC7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DF7D second address: 119E031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, 00B952BDh 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F11310835A8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jmp 00007F11310835B8h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e cld 0x0000003f mov eax, dword ptr [ebp+122D039Dh] 0x00000045 xor dword ptr [ebp+122D5D58h], edi 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F11310835A8h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 0000001Bh 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 mov dword ptr [ebp+1244BB1Dh], esi 0x0000006d mov ebx, dword ptr [ebp+122D2E6Dh] 0x00000073 mov ebx, dword ptr [ebp+122D3E71h] 0x00000079 nop 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d je 00007F11310835A6h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E031 second address: 119E035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E035 second address: 119E058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 js 00007F11310835A8h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F11310835B0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EF1C second address: 119EF21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0A1B second address: 11A0A20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2A7F second address: 11A2A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4F5D second address: 11A4F63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4F63 second address: 11A4FCC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1131072E18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F1131072E18h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push esi 0x00000028 pop ebx 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D34EDh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F1131072E18h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d cld 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 jno 00007F1131072E20h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF310 second address: 11AF316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF316 second address: 11AF31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEB6A second address: 11AEB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F11310835B5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEB84 second address: 11AEB89 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEB89 second address: 11AEBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F11310835A6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F11310835B4h 0x00000012 jne 00007F11310835A6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEBB0 second address: 11AEBB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEE77 second address: 11AEE7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF4F7 second address: 11BF4FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF4FD second address: 11BF547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F11310835AAh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edx 0x00000012 push eax 0x00000013 ja 00007F11310835A6h 0x00000019 pop eax 0x0000001a pop edx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F11310835ABh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 jmp 00007F11310835B5h 0x0000002c push ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF685 second address: 11BF6A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F1131072E1Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF724 second address: 11BF728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B84 second address: 11C5B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B8A second address: 11C5B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B90 second address: 11C5B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B99 second address: 11C5B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5B9F second address: 11C5BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1131072E26h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5D33 second address: 11C5D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5D46 second address: 11C5D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5EC0 second address: 11C5EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5EC6 second address: 11C5ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C607D second address: 11C608E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835ADh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C61F3 second address: 11C61FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1131072E16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6503 second address: 11C6507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6625 second address: 11C6629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A43D second address: 118A463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F11310835B7h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A798 second address: 118A7AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A7AF second address: 118A7DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F11310835B0h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c or dword ptr [ebp+122D1C56h], edx 0x00000012 mov dh, 16h 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F11310835ACh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB4C second address: 118AB60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1131072E20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB60 second address: 118AB64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B39C second address: 118B3B9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1131072E1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1131072E1Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B3B9 second address: 118B446 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F11310835B4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F11310835B7h 0x00000010 lea eax, dword ptr [ebp+1247FDB9h] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F11310835A8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D31F7h], esi 0x00000036 push edi 0x00000037 jnl 00007F11310835ACh 0x0000003d pop edx 0x0000003e nop 0x0000003f push edx 0x00000040 push ebx 0x00000041 jmp 00007F11310835AAh 0x00000046 pop ebx 0x00000047 pop edx 0x00000048 push eax 0x00000049 js 00007F11310835B2h 0x0000004f jc 00007F11310835ACh 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B446 second address: 118B49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 push ecx 0x00000008 call 00007F1131072E18h 0x0000000d pop ecx 0x0000000e mov dword ptr [esp+04h], ecx 0x00000012 add dword ptr [esp+04h], 0000001Ch 0x0000001a inc ecx 0x0000001b push ecx 0x0000001c ret 0x0000001d pop ecx 0x0000001e ret 0x0000001f lea eax, dword ptr [ebp+1247FD75h] 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007F1131072E18h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B49E second address: 118B4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B4A3 second address: 118B4AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA5A second address: 11CAA69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA69 second address: 11CAA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA6F second address: 11CAA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F11310835A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA7B second address: 11CAA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA7F second address: 11CAA83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAA83 second address: 11CAAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F1131072E28h 0x0000000e js 00007F1131072E16h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAAAC second address: 11CAAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAC11 second address: 11CAC15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B3A6 second address: 118B3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F11310835AAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CAD94 second address: 11CAD9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD685 second address: 11CD689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD689 second address: 11CD6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F1131072E22h 0x0000000c push edi 0x0000000d jns 00007F1131072E16h 0x00000013 pop edi 0x00000014 push eax 0x00000015 jmp 00007F1131072E27h 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1131072E1Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD6D1 second address: 11CD6D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD6D7 second address: 11CD6DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD6DF second address: 11CD6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2893 second address: 11D28AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1131072E23h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC3B5 second address: 11DC3D6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F11310835AAh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F11310835B3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC3D6 second address: 11DC3E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F1131072E16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC3E7 second address: 11DC3EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC3EB second address: 11DC400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0CF6 second address: 11E0D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F11310835B8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0D13 second address: 11E0D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F1131072E16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0E64 second address: 11E0E6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0E6B second address: 11E0E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1131072E20h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F1131072E27h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1017 second address: 11E1028 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F11310835A6h 0x00000009 jp 00007F11310835A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E12C8 second address: 11E12CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E15DD second address: 11E15ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jne 00007F11310835A6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E190F second address: 11E1914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1914 second address: 11E195E instructions: 0x00000000 rdtsc 0x00000002 js 00007F11310835B3h 0x00000008 jmp 00007F11310835ABh 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F11310835AFh 0x00000017 jl 00007F11310835A6h 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 jbe 00007F11310835B6h 0x00000027 jno 00007F11310835A6h 0x0000002d jmp 00007F11310835AAh 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E195E second address: 11E196A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1131072E16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1DC9 second address: 11E1DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1DCD second address: 11E1DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E21FB second address: 11E2201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A33 second address: 11E0A38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A38 second address: 11E0A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F11310835A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A44 second address: 11E0A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1131072E1Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E61CE second address: 11E61D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E61D3 second address: 11E61DD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1131072E2Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7D49 second address: 11E7D67 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F11310835C0h 0x00000008 jmp 00007F11310835B4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7D67 second address: 11E7D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007F1131072E16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7D75 second address: 11E7D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA299 second address: 11EA2B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1131072E1Dh 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9FCA second address: 11E9FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFCEB second address: 11EFCF5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1131072E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F004D second address: 11F0073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835B5h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jno 00007F11310835AEh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0416 second address: 11F0424 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1131072E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0424 second address: 11F0428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3D54 second address: 11F3D5A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3D5A second address: 11F3D7B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F11310835A6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F11310835B3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F33E6 second address: 11F33EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F33EC second address: 11F340A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835B8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F340A second address: 11F3417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F1131072E22h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3417 second address: 11F3434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F11310835A6h 0x0000000a push ebx 0x0000000b jg 00007F11310835A6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 pushad 0x00000015 jnc 00007F11310835A6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3A1C second address: 11F3A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8757 second address: 11F8766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8C6D second address: 11F8C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8C71 second address: 11F8C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F11310835AAh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007F11310835A8h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 je 00007F11310835A6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8DE3 second address: 11F8DE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8DE8 second address: 11F8DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8DF4 second address: 11F8DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1131072E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ADE2 second address: 118ADF1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ADF1 second address: 118ADF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F90EA second address: 11F90EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F90EE second address: 11F90F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F90F4 second address: 11F9116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F11310835ADh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F11310835A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9116 second address: 11F9133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9133 second address: 11F9138 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9138 second address: 11F913E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120175F second address: 1201771 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201771 second address: 1201791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1131072E27h 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A53 second address: 1201A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F11310835A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A60 second address: 1201A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A64 second address: 1201A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201D5E second address: 1201D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206715 second address: 1206747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F11310835B3h 0x0000000c jmp 00007F11310835B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12068A9 second address: 12068AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12068AD second address: 12068D0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F11310835A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F11310835B9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12068D0 second address: 12068E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E1Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206A73 second address: 1206A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F11310835ACh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206B9F second address: 1206BB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1131072E1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206BB3 second address: 1206BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206BB9 second address: 1206BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206BBE second address: 1206BC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206EAD second address: 1206ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E20h 0x00000009 pop eax 0x0000000a jmp 00007F1131072E1Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121280F second address: 1212815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212AF2 second address: 1212AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212AF6 second address: 1212AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212C59 second address: 1212C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DB9 second address: 1212DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DBD second address: 1212DC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DC2 second address: 1212DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DC8 second address: 1212DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F1131072E1Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F1131072E1Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DE7 second address: 1212DEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DEC second address: 1212DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212DF2 second address: 1212E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F11310835A6h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212F7D second address: 1212F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1131072E20h 0x0000000f jns 00007F1131072E16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12133D5 second address: 12133F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F11310835B8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213540 second address: 1213558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1131072E20h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213558 second address: 1213560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213560 second address: 1213566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213566 second address: 1213570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F11310835A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213570 second address: 1213574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218809 second address: 1218816 instructions: 0x00000000 rdtsc 0x00000002 js 00007F11310835A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218816 second address: 1218829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E1Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D20C second address: 121D211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D211 second address: 121D287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1131072E28h 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F1131072E25h 0x0000000f jmp 00007F1131072E26h 0x00000014 popad 0x00000015 jmp 00007F1131072E29h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F1131072E1Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D287 second address: 121D2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F11310835B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D2A7 second address: 121D2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1131072E16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D2B2 second address: 121D2C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F11310835AFh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121D2C7 second address: 121D2CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F9C7 second address: 122F9EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F11310835ABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F9EF second address: 122F9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F5CC second address: 122F5E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835B8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12312FD second address: 1231301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234D32 second address: 1234D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F11310835B0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FE15 second address: 113FE2D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1131072E1Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A625 second address: 124A631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F11310835A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A631 second address: 124A635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248DED second address: 1248DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F11310835A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248DF7 second address: 1248DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248F70 second address: 1248F9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F11310835A6h 0x00000009 jmp 00007F11310835B6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 jl 00007F11310835AEh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249245 second address: 1249249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124939E second address: 12493AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12493AC second address: 12493C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007F1131072E16h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F1131072E16h 0x00000015 jno 00007F1131072E16h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124955E second address: 1249563 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249563 second address: 124956E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12496A0 second address: 12496F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F11310835ABh 0x00000007 jmp 00007F11310835B9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007F11310835ADh 0x00000014 jnp 00007F11310835A6h 0x0000001a pop ebx 0x0000001b jmp 00007F11310835ADh 0x00000020 popad 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 push edx 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DE11 second address: 124DE19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255B30 second address: 1255B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255B34 second address: 1255B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F1131072E23h 0x0000000c pushad 0x0000000d ja 00007F1131072E16h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jne 00007F1131072E16h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12570E5 second address: 1257100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F11310835B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699AB second address: 12699B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699B1 second address: 12699B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12699B7 second address: 12699BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12694AE second address: 12694B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F11310835A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126966C second address: 1269670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270BF0 second address: 1270BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270BF4 second address: 1270C05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1131072E1Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C05 second address: 1270C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C0C second address: 1270C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F1131072E25h 0x00000011 jp 00007F1131072E16h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C34 second address: 1270C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C3C second address: 1270C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270E0C second address: 1270E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710D8 second address: 12710DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127139A second address: 12713BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F11310835B4h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271501 second address: 127151C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007F1131072E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1131072E1Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271663 second address: 1271690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835B1h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jbe 00007F11310835AAh 0x0000001a push edi 0x0000001b pop edi 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271690 second address: 12716B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E27h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12716B2 second address: 12716B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12716B6 second address: 12716BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274A39 second address: 1274A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F11310835B0h 0x00000009 jl 00007F11310835A6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274A56 second address: 1274A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1131072E20h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274A6B second address: 1274A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276713 second address: 1276719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A399 second address: 127A3B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F11310835AEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128032F second address: 1280333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FED9 second address: 127FEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281EF6 second address: 1281F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1131072E22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274BCF second address: 1274BD9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F11310835ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274E5E second address: 1274E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274E67 second address: 1274E80 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F11310835AEh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277484 second address: 127748B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127748B second address: 127749A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F11310835A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127749A second address: 127749E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127749E second address: 12774A8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F11310835A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E6EC second address: 118E6FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jng 00007F1131072E16h 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E937 second address: 118E93D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E93D second address: 118E941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E941 second address: 118E945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E945 second address: 118E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F1131072E16h 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 121EDEC instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 49D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4A60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0115BF09 rdtsc

0_2_0115BF09

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 3892

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0115BF09 rdtsc

0_2_0115BF09

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FDB7DE LdrInitializeThunk,

0_2_00FDB7DE

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: nProgram Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562254
Start date and time:	2024-11-25 12:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, tse1.mm.bing.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	XFO-E2024-013 SMP-10.3-F01-2210 Host spare parts.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	05.Unzipped.obfhotel22-11.js	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	13.107.246.63
	fusioncharts.charts.js	Get hash	malicious	Unknown	Browse	13.107.246.63

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.517887639932633
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'846'720 bytes
MD5:	d30bd6bc4ce8e63cd599e4d1b604c815
SHA1:	c79f06015669a06f56c7f3ce81e4b5f18c91d867
SHA256:	53705aeb862870ba7f20fcbe388077b9b47f049a6132ae4b3fe9a23208f5897f
SHA512:	847adf10aea75d02d7cfb45331946270f97624dc918ced6349c5c4b181fed23508fb67e64384c5d971a38fe4f318fd6ab985982f97a6b7fe483b6de426f612cd
SSDEEP:	24576:WgbYExwjbCl68QV52vzjYStIfac1BgOfuhELyisFa8fYaSHPDJjvjI/xLz3e1SA2:W/tbAq5uj+b/4JFrkLtQv3e9+ssd
TLSH:	C7D54AA2B54972CFE88E37749527CD4B6D6D03BA47244CC3A82D78BA7D63CC125B5C28
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.......+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6be000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1130B9B0CAh
cmovle ebp, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+1Eh], ah
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [esi], bl
adc dword ptr [eax], edx
add byte ptr [eax], al
add byte ptr [eax], al
cwde
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	1d3fc6150076ab5123980e4d77990c53	False	0.9344618055555556	data	7.809790627438205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
frqkrlxj	0xa000	0x2b2000	0x2b1000	2bd18149cc641d5bb286d5b55667814e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fygxckij	0x2bc000	0x2000	0x400	b0593e80d94dfb1526e4f152948274e7	False	0.8212890625	data	6.288643960573603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2be000	0x4000	0x2200	d83071de97578abc10db1a841e7fc349	False	0.05583639705882353	DOS executable (COM)	1.1230292077953017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 12:08:05.528350115 CET	1.1.1.1	192.168.2.6	0xd87a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 12:08:05.528350115 CET	1.1.1.1	192.168.2.6	0xd87a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:08:07
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfd0000
File size:	2'846'720 bytes
MD5 hash:	D30BD6BC4CE8E63CD599E4D1B604C815
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	8.8%
Signature Coverage:	5.8%
Total number of Nodes:	137
Total number of Limit Nodes:	7

Executed Functions

Function 011595D5 Relevance: 1.6, APIs: 1, Instructions: 104
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 011595D5

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c0c28e1bd7184e91e017a642326850400b7da721efe46a5d71fe0efd177e226f
Instruction ID: 35884f55c6fae95ee1a32e8f75de02292d15e8b9400f00688e4788905fb8fe34
Opcode Fuzzy Hash: c0c28e1bd7184e91e017a642326850400b7da721efe46a5d71fe0efd177e226f
Instruction Fuzzy Hash: 2A315CB251C604EFE30DAF28D8816BAFBE5FB58314F02491EE6D583650D73154408A97

Function 0115BF09 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0115BF44

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc551032563d6bd8354f8528c6fe5536402b70922b829d525c71af45d42df895
Instruction ID: 7e2b0e70967945ac3a1ba3d6e3f416c9ccfc2b81a11c2da2c0c2e2355dd7976c
Opcode Fuzzy Hash: dc551032563d6bd8354f8528c6fe5536402b70922b829d525c71af45d42df895
Instruction Fuzzy Hash: B50147B314C21A7CE38A8D981E61BFE775ED382630F314126FD25E7583D3810C09067A

Function 00FDB7DE Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 00FDB94E

Memory Dump Source

Source File: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 408a3377716eef83c080ea2a69a783bfcb0d24b5383ba35d423aa5fa4647ea54
Instruction ID: 3a1de66f9b0a1c6aeb9e67eda870b6e4b95bf13198a904ce3badd7dda35f7321
Opcode Fuzzy Hash: 408a3377716eef83c080ea2a69a783bfcb0d24b5383ba35d423aa5fa4647ea54
Instruction Fuzzy Hash: A9E0C2B22048C5CACB16AF608C2179D770FDF40700F9D0116FB419AF85CB2E0D12E756

Function 011B3494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 011B35A5
LoadLibraryExA.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 011B35B9

Strings

.exe, xrefs: 011B3500
1002, xrefs: 011B356F

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .exe$1002
API String ID: 1029625771-4238571270
Opcode ID: 99c21d5f2bd46d11ce3fe87b80e19302b8618082a6020dd0bc6d42dc553c64ea
Instruction ID: 50d542b227717188f34a6866f564f4a617585f11a1a9c200b9233ba1c6221ed2
Opcode Fuzzy Hash: 99c21d5f2bd46d11ce3fe87b80e19302b8618082a6020dd0bc6d42dc553c64ea
Instruction Fuzzy Hash: 1F31897541010AEFDF2EAF54E984AEE7BB5FF18304F018169F92296060D7319AB0DB91

Function 011B62F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00765234,-112F5FEC), ref: 011B636D
GetFileAttributesA.KERNEL32(00000000,-112F5FEC), ref: 011B637B

Strings

@, xrefs: 011B6320

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: fcf500126c490f217968285ec11c24646cee0c79bd84438a2976363fb5990122
Instruction ID: eb7d9a5900c7323a9631b50e8c027745f8d1269fc3c86634059bd17befaae0b4
Opcode Fuzzy Hash: fcf500126c490f217968285ec11c24646cee0c79bd84438a2976363fb5990122
Instruction Fuzzy Hash: FA01FF3110D206FAEF2EDF68C889BEC7F70AF20348F058160E50B660B0C7749A85CB01

Function 011B3767 Relevance: 4.6, APIs: 3, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,0000028B,-112F5FEC,00000000,?), ref: 011B37A7
GetFullPathNameA.KERNEL32(?,0000028B,?,00000000,-112F5FEC,?), ref: 011B37F7
GetModuleFileNameA.KERNELBASE(?,?,?), ref: 011B3870

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: Name$FileModule$FullPath
String ID:
API String ID: 3489545109-0
Opcode ID: 6130736a7b28b75b03ae6a74a9133ef24875858ead04a3bbe73ea4011dbd2a59
Instruction ID: 0644007b50ca07b901e61e6957313cf260ab89bcf53108c3727fd302d8c7cef7
Opcode Fuzzy Hash: 6130736a7b28b75b03ae6a74a9133ef24875858ead04a3bbe73ea4011dbd2a59
Instruction Fuzzy Hash: 6731547160021AFFEB2AEF58DC88FDEBBB8BF05244F004694E11A96150C7305AA5CB21

Function 011B6510 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00765234,?,-112F5FEC,?,?,?,?,-112F5FEC), ref: 011B65C2

Part of subcall function 011B64C2: IsBadWritePtr.KERNEL32(?,00000004), ref: 011B64D0

CreateFileA.KERNEL32(?,?,-112F5FEC,?,?,?,?,-112F5FEC), ref: 011B65E2

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 5ab6aabceaef31cd30fdd50f5419ae76be6c601b19ce3fb5cb4e16981e70fcb0
Instruction ID: 79f9ffe31e6c0b912003b5bde522251071451cca32c1f5cbf9a9836703c67253
Opcode Fuzzy Hash: 5ab6aabceaef31cd30fdd50f5419ae76be6c601b19ce3fb5cb4e16981e70fcb0
Instruction Fuzzy Hash: CE11EA3110414AFBDF2A9F94DD88BDE3E62BF24284F054115FA06654A4C376C6B5EB51

Function 011B399A Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,011B392C,?,00000000,00000000), ref: 011B3A57
GetModuleHandleA.KERNEL32(00000000,?,?,011B392C,?,00000000,00000000), ref: 011B3A65

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 057f127f0861e7d406e49b2b48fd25903d246e490e619ab23f08608bcd780cf6
Instruction ID: aad243522afbcbd3728e07797d01393b074d19908739075d1265376f19afa44d
Opcode Fuzzy Hash: 057f127f0861e7d406e49b2b48fd25903d246e490e619ab23f08608bcd780cf6
Instruction Fuzzy Hash: FD112A30514606FFEB7DDF29C8887D97A71BB00745F104215E922894E0D77995B4CA92

Function 011B5E7C Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(-112F5FEC), ref: 011B5E89
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011B5EEF

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CurrentDuplicateHandleProcess
String ID:
API String ID: 1009649615-0
Opcode ID: fd7f7f9cfeb5db0740ec25b0fdd42b95d76f3a7745960c66128b0125bbcca2ce
Instruction ID: 93ba927661e00a7b807c473d1ca077f1851bec6362f0154d57a890804073e112
Opcode Fuzzy Hash: fd7f7f9cfeb5db0740ec25b0fdd42b95d76f3a7745960c66128b0125bbcca2ce
Instruction Fuzzy Hash: 0001FB3210015AFA8F2AAFA8DC94CDF7F7ABF686587018515FA1295054D731D0A2EB71

Function 011B38A1 Relevance: 3.0, APIs: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,00000000,-112F5FEC,?,00000000,?), ref: 011B38E7
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,-112F5FEC,?,00000000,?), ref: 011B3906

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide
String ID:
API String ID: 1532159127-0
Opcode ID: 4dffdb0089d62b6f6dcb2e09e67b0cd5c974e2ac56d092f1bb08322a3b43c7f9
Instruction ID: 36bc1426bd12532fa83de73ba36400cfab056053930c32766efbc38fe3965217
Opcode Fuzzy Hash: 4dffdb0089d62b6f6dcb2e09e67b0cd5c974e2ac56d092f1bb08322a3b43c7f9
Instruction Fuzzy Hash: 9E01163250024AFBDF169F94CC48ADE7F72FF44354F108168FA21651A0C7318661EB10

Function 0115BFDA Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 40568d2d11b3ddf1d6de8e716672cfac9312cc93914bac6cc4f0b330a14cc69f
Instruction ID: f769a193face4cead04216fab926b772960e7ffe42e262aa7cd3e306c61ff890
Opcode Fuzzy Hash: 40568d2d11b3ddf1d6de8e716672cfac9312cc93914bac6cc4f0b330a14cc69f
Instruction Fuzzy Hash: D621C0AB20C365BDE7AA8D45AD60BFB6B6CD7C3630F318027FD55D6042D354090982B5

Function 01159737 Relevance: 1.6, APIs: 1, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 01159737

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9771bd54dd979f417b51e0dabba4cb6cdf68add516240d24ee59917e1183cab2
Instruction ID: 8b9def98e0d8ec15a90dd466e7f842a9df0f8be092131118fdca9af317aebb85
Opcode Fuzzy Hash: 9771bd54dd979f417b51e0dabba4cb6cdf68add516240d24ee59917e1183cab2
Instruction Fuzzy Hash: F03137B250D704AFD7067F19D88567AFBE9FF94320F26482DE6C483250EA719850CA87

Function 0115C01E Relevance: 1.6, APIs: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 66f1a18f27712fdc7a4b93883a1755e675bfc11dce3052f7dc8057edb5c15cf0
Instruction ID: 6b3c8fa0c6c3b22e83d54f91b838f1c71e63e72356004524422a58bf1fa6238c
Opcode Fuzzy Hash: 66f1a18f27712fdc7a4b93883a1755e675bfc11dce3052f7dc8057edb5c15cf0
Instruction Fuzzy Hash: 33118EBF208221BC76A9CD4ABE50FFBA76DE5C7A70731842BFC16D2102D3510D0991B1

Function 0115C030 Relevance: 1.6, APIs: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ba4ca5dbb148bc0fa73f08bd7fe66319c58f9d2ac06882f6dca3270bd9d3e64c
Instruction ID: 1469ed63a7e242ed352d7ce984ac971b52c3137527aeeb327743e4a6fea14d80
Opcode Fuzzy Hash: ba4ca5dbb148bc0fa73f08bd7fe66319c58f9d2ac06882f6dca3270bd9d3e64c
Instruction Fuzzy Hash: BA118EBB208225BC77A9CD4A7E54FFBAB2DD5C3A70731842BFC56D2002E351094A41B1

Function 011B44FB Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 011B45B0

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95b1683f2bad4a80ee31aedbb5994c2175bb94474c279d0a6db47a064095c03a
Instruction ID: e7d1e21782fd5a27e42e8ef8dbb1adce1e9847201aea510ae89eef506d09a5bb
Opcode Fuzzy Hash: 95b1683f2bad4a80ee31aedbb5994c2175bb94474c279d0a6db47a064095c03a
Instruction Fuzzy Hash: 44318D71A00209FAEB29DFA4DC84FEDBBB8FF44318F208169F916AA591C7719651CB10

Function 0115C06A Relevance: 1.6, APIs: 1, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 012daae8054e0b87349043f0c9ac17b3edd2c61e5648cc967f4842bc30e92b32
Instruction ID: 03b34274dae3acd2edb44fb09a5fc5166a357f30b7ff86b2684a593704361705
Opcode Fuzzy Hash: 012daae8054e0b87349043f0c9ac17b3edd2c61e5648cc967f4842bc30e92b32
Instruction Fuzzy Hash: 30119DBB248226BC76A9CD4A6E50FFBA76DE5C3A70731842BFC16D6102E3400D0951B1

Function 0115C054 Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c3a7e1b11c6c3eacdb31b4d38c7b80170f11f5010bde4e85c4cdf2735cffeb57
Instruction ID: f6623392da32fe92e1b9dbb9916f1f130c774f973936bb89c780f1859f6313d8
Opcode Fuzzy Hash: c3a7e1b11c6c3eacdb31b4d38c7b80170f11f5010bde4e85c4cdf2735cffeb57
Instruction Fuzzy Hash: 7A11BCBB24C226BC7669CD46AE54EFBAB2DD5C3670731842BFC66C2542E350090E91B1

Function 011B3D17 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 011B3D99

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: be376f0aa648225c8581f5a3221ea5e91b7973e2a1c943c01845717136311d92
Instruction ID: dade70525040434fc69f69dd1dd3fb2f8a4f788bb2c1f385648eeeb7c32d2bf3
Opcode Fuzzy Hash: be376f0aa648225c8581f5a3221ea5e91b7973e2a1c943c01845717136311d92
Instruction Fuzzy Hash: 38318171640205BEEB359F68DC85FDDBBB8BF04728F20425AF621AA1D1D3B1A551CB14

Function 0115C0E3 Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26da82695301d857c0bec744ca25c11ef2c3626d3d32849d69ffa5f8eb257f69
Instruction ID: 217e13258fdf7b806981413a5e6f501e9a3a7c09f94de523c6a010e8f4bd731f
Opcode Fuzzy Hash: 26da82695301d857c0bec744ca25c11ef2c3626d3d32849d69ffa5f8eb257f69
Instruction Fuzzy Hash: 4901ADBB20C265BCB766CC466E50FFB6B2CD6C6A70B31842BFC56C2442D305090E82B1

Function 0115C10B Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5d3b85f7f81d4ac37b2705a3912318ba1da9a466bbaba9546152d5b9485f5368
Instruction ID: 664d05cb21e2cbc81398fefd6fb5b1463f87c6e72f45e7d70fdbc7dbe49a0d43
Opcode Fuzzy Hash: 5d3b85f7f81d4ac37b2705a3912318ba1da9a466bbaba9546152d5b9485f5368
Instruction Fuzzy Hash: AC0180BB20C395FDB755C996AE50FFB7B6CD6C6630731942BF812C6442C350080A86B5

Function 0115C0B6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,0115C01A,00000003), ref: 0115C0D8

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bf0a2e1615ad6c88fffaa46e7841389d9f139c070fed3a0e59cdf43a2feb48a6
Instruction ID: 747928f74e88748c5d7977a27c5893fc60a74fe6996e09d7a7480b0b9c5a4308
Opcode Fuzzy Hash: bf0a2e1615ad6c88fffaa46e7841389d9f139c070fed3a0e59cdf43a2feb48a6
Instruction Fuzzy Hash: 7DF0A9BB20C265BCB664C98ABE24FFBBB2CD1C6A30731842BFC16C2042D3540D0E81B0

Function 049D0D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 049D0DCD

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: f306bf4b0f3399e1d912b9d7a8f35ce994b686946f0eb851760ffc8de51f5524
Instruction ID: ffd5a0d6ef3d03a1e7d2114a4a05d11e1bf63f42d4d9a434436cc500dd7aa95a
Opcode Fuzzy Hash: f306bf4b0f3399e1d912b9d7a8f35ce994b686946f0eb851760ffc8de51f5524
Instruction Fuzzy Hash: 7F2135B6C00309DFCB50CF99D884ADEFBF4FB88710F14822AD809AB204C734A540CBA4

Function 049D0D43 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 049D0DCD

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 8ad933fdc6b53d54e38405b314cc1a383db48b3e96c0e915df5bad30452846ea
Instruction ID: bc87e8312d6ba48c50642fdb437ea049d19f3d7ff80b6550e3c266888f7798f1
Opcode Fuzzy Hash: 8ad933fdc6b53d54e38405b314cc1a383db48b3e96c0e915df5bad30452846ea
Instruction Fuzzy Hash: 3A2132B6800309CFDB40CF99D484ADEFBF1BB88320F15822AD909AB204C734A941CFA4

Function 049D1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 049D1580

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: da19137f72bafc5a63792b9235f30e69f778db866ed4dd8bb0e488ce28a50ea8
Instruction ID: 03c312a1b4c2c56b1d5b2ef67b5267267ad1b83d44f6c823fa876682560c9c73
Opcode Fuzzy Hash: da19137f72bafc5a63792b9235f30e69f778db866ed4dd8bb0e488ce28a50ea8
Instruction Fuzzy Hash: 9411D3B5900749DFDB10CF9AC585BDEFBF4AB48320F10802AE559A7250D378A644CFA5

Function 049D1509 Relevance: 1.6, APIs: 1, Instructions: 51serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 049D1580

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: c84d19c91c3149ae14beb04ffaa8db28263f460150d5eed94a9205fbe3f2178f
Instruction ID: 2915a5cdbfd77bfee3d7da130ee6611f7eb81dd476ce998ecf482d94134aecc2
Opcode Fuzzy Hash: c84d19c91c3149ae14beb04ffaa8db28263f460150d5eed94a9205fbe3f2178f
Instruction Fuzzy Hash: 521100B6900309CFDB10CF9AC585BDEFBF4BB48320F10842AE558A7250D778AA44CFA5

Function 011B7048 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?), ref: 011B70CF

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: b5791c1c39eb378e7f89f38fe2132e759de129e1ae8c74534b290a593d146958
Instruction ID: 04de45b0654f14960d265762b3fa8a4290d5980fe700f363986405258fa5d1c2
Opcode Fuzzy Hash: b5791c1c39eb378e7f89f38fe2132e759de129e1ae8c74534b290a593d146958
Instruction Fuzzy Hash: 0211BA3650010BFFDF2A6FA4DC95DDF3F66AFA9244B018512F612550A0C736C5B2EB62

Function 011B6E30 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab86c22357bbdc0008f5d28452a58d060dd74b6473ac666d53bbfd7335428b7
Instruction ID: 5dd3e87044ad5e3ed161a345cf2b9fceec4af577bcc9cab47d151050c7d0d819
Opcode Fuzzy Hash: 4ab86c22357bbdc0008f5d28452a58d060dd74b6473ac666d53bbfd7335428b7
Instruction Fuzzy Hash: FC111B3210025AFADF1EEFA8DC88ADF3B76AF64344F058414F91256060C736D671DB61

Function 049D1301 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 049D1367

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 08b9d85ab7dcc91bf0ca2efd7b6cbcb3ff44bc31ed35b60bda99de64c560b263
Instruction ID: 19fb1949c14b580ca9e85c0934eb9c97994f9e0d2bd7219a4e0793cd3e712ab3
Opcode Fuzzy Hash: 08b9d85ab7dcc91bf0ca2efd7b6cbcb3ff44bc31ed35b60bda99de64c560b263
Instruction Fuzzy Hash: CB1113B1800649CFDB10CF9AC485BDEFBF4EB48320F20846AD558A7641D778A544CFA5

Function 049D1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 049D1367

Memory Dump Source

Source File: 00000000.00000002.2392655172.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 428c460cf5f6d7caa67713e3bf61e66a78d5de4b3d0ec392a2cd6312062cd722
Instruction ID: feb9d198854942d326a821b9c7ec1184e4bda85dbd81515121468bed665c410e
Opcode Fuzzy Hash: 428c460cf5f6d7caa67713e3bf61e66a78d5de4b3d0ec392a2cd6312062cd722
Instruction Fuzzy Hash: C01133B1800349CFDB10CF9AC445BDEFBF8EB48320F20842AE558A3640D778A944CFA5

Function 011B6714 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?,00000400,?,?,?,011B4443,?,?,00000400,?,00000000,?,00000000), ref: 011B6780

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e03a17e162b441b45903a6315034253f5aab44f002fe3e2fa56b62ca103b4d29
Instruction ID: fd4f01a3675a0da55a3d94039910a874af7adf3617531630cf3a7ff121f61360
Opcode Fuzzy Hash: e03a17e162b441b45903a6315034253f5aab44f002fe3e2fa56b62ca103b4d29
Instruction Fuzzy Hash: 18F0373610450AFBCF1AAF98DC98DDF3F66BF64644F018411FA124A060D732C8B2EB61

Function 011B3A83 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 011B3AE7

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e05ed35309558100c809018780c6d2e258d861175e005a8e3d69b7d0dba8367b
Instruction ID: 4737785b9f1f8f6eecf73bdbfa6d23364fc6731e9df9dfec7eb81fc408977e4f
Opcode Fuzzy Hash: e05ed35309558100c809018780c6d2e258d861175e005a8e3d69b7d0dba8367b
Instruction Fuzzy Hash: 03F09075600205AFDF19EF68D8C9AEE7BA4FF14354F218415FE26C6151C331C5A0DA51

Function 0115C298 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0115C29E

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ec28ef3c199eb7b19af9ac82238ed21b428f4062b1bcd97511c113230dac3bb
Instruction ID: e7668cdc53fcb5005db92703b109111c3b21c4d5877873aa27ae62b2b3447b4d
Opcode Fuzzy Hash: 3ec28ef3c199eb7b19af9ac82238ed21b428f4062b1bcd97511c113230dac3bb
Instruction Fuzzy Hash: 05E0262366837EB8E3EC5AF818627BA2748C790264F20012AAA68EA0C2C158080542A9

Function 011B4B15 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(011B44D8,?,?,011B44D8,?), ref: 011B4B53

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4b7a68cd39360f1191843dd4de55639f72f70d1d65d556545be846c0fae99707
Instruction ID: 1ada096879c308b102574f18fde937efa6a423af837da7e0670e5c075a22eefb
Opcode Fuzzy Hash: 4b7a68cd39360f1191843dd4de55639f72f70d1d65d556545be846c0fae99707
Instruction Fuzzy Hash: 0DE04872104153B5CE2D7E69E998ECFAE796FA06487014521F51346411C721C092D561

Function 00FDF10D Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00FDFC18

Memory Dump Source

Source File: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5dbe43114c7b7197ab245d2b199a04a472bfbebd245abce07c3f7e18a3889333
Instruction ID: cceb448f01a1f9436ff5aa7a80da039c5bde762af596c00bb4949b8ef52fe051
Opcode Fuzzy Hash: 5dbe43114c7b7197ab245d2b199a04a472bfbebd245abce07c3f7e18a3889333
Instruction Fuzzy Hash: EBE04F7244C28ACBC744AF30C419A6E77B1EF00360F14052ADD9386390D7328C64EE06

Function 011B3BDA Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011B3BE0

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2685606a32d9a5b43b2319700d854d2f299d15cfdfa6e009d8f0f4b95b1d8122
Instruction ID: 391443f616482690001b56401fd919ed89d69d60289f4f51675f1dfadcde7e9f
Opcode Fuzzy Hash: 2685606a32d9a5b43b2319700d854d2f299d15cfdfa6e009d8f0f4b95b1d8122
Instruction Fuzzy Hash: 09B09231014109BBCB15BF55ED0698DFF7ABF21298B008121F916444218BB2E970ABD4

Non-executed Functions

Function 0115516B Relevance: 4.3, Strings: 3, Instructions: 536COMMON

Download Yara Rule

Strings

Ql?|, xrefs: 01155789
U~/o, xrefs: 01155713
^-}, xrefs: 01155197

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID:
String ID: Ql?|$U~/o$^-}
API String ID: 0-4118198975
Opcode ID: d88e5f58a318e79f8d36db00bd35485e550a0028d23dd1261b7e480f947838a9
Instruction ID: ab95f96eec6333e59b9091bee28f3bedf65354d3945ed0a83d54635bb5276ec6
Opcode Fuzzy Hash: d88e5f58a318e79f8d36db00bd35485e550a0028d23dd1261b7e480f947838a9
Instruction Fuzzy Hash: A6F1D1F260C2049FE304AF29EC8567AFBE5EF98720F16493DEAC487740EA3558458797

Function 011B6DCC Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 011B6E13

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: e59cf84a6bfc671be4bce69cdbec13b1cf3b76c9e578478daea6f260a24bec3a
Instruction ID: 44c69af0f5ff3f7c41510d7c9cb28eaf0013eb370d227fe6dd7b5eaa84e73380
Opcode Fuzzy Hash: e59cf84a6bfc671be4bce69cdbec13b1cf3b76c9e578478daea6f260a24bec3a
Instruction Fuzzy Hash: 19F0F83260120AEFCF05CF94C9459CD7BB1FF19304B108029F916AA251D7769AB0EF80

Function 011595F0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8d5978833354d8c35ae6dd6da9f3659f6a338e5413a6be2d551d107486ffc2
Instruction ID: 746f4ed4b3f45c7930a4f506217f4c6997f1fae19e3363828df7403c2dd889ee
Opcode Fuzzy Hash: 2f8d5978833354d8c35ae6dd6da9f3659f6a338e5413a6be2d551d107486ffc2
Instruction Fuzzy Hash: 76314DB251C604EFE309AF29DC86ABAFBE5FB58310F42492DE6C583650E7315840CB97

Function 01159606 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df611d212996a5528f69901c34581783a925248463d9984a41dfcd362ee2244
Instruction ID: 7e210c85db22d78ff80c09daaca34bb24ac4b47a6aec4eee073faad263d86600
Opcode Fuzzy Hash: 0df611d212996a5528f69901c34581783a925248463d9984a41dfcd362ee2244
Instruction Fuzzy Hash: 023149B250C600EFE309AF29D886ABAFBE5FB58310F02492DE6C583654D7316840CB97

Function 011B5444 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 011B64C2: IsBadWritePtr.KERNEL32(?,00000004), ref: 011B64D0

wsprintfA.USER32 ref: 011B548A
LoadImageA.USER32(?,?,?,?,?,?), ref: 011B554E

Strings

%8x, xrefs: 011B5518, 011B554B
%8x, xrefs: 011B5485, 011B5488

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: ImageLoadWritewsprintf
String ID: %8x$%8x
API String ID: 416453052-2046107164
Opcode ID: 0d04cc7792d2fae1821bb8f4460daf0fc56d0ff25a46464607fccfb278222f24
Instruction ID: 7252209dd36582d902f1c11464ffc1a0735beabd859c4de10311d2ca269080ae
Opcode Fuzzy Hash: 0d04cc7792d2fae1821bb8f4460daf0fc56d0ff25a46464607fccfb278222f24
Instruction Fuzzy Hash: 3131067290010AFBDF15DF94DC89EEEBBBAFF54700F108125F512A6160D7319A61DB60

Function 011B6015 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00765234,00004020,00000000,-112F5FEC), ref: 011B6102

Strings

@, xrefs: 011B6041

Memory Dump Source

Source File: 00000000.00000002.2388282757.00000000011B3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000000.00000002.2387653002.0000000000FD0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387668716.0000000000FD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387693220.0000000000FD6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387711539.0000000000FDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387738840.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387846344.000000000113C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387865487.000000000113F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001155000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387889184.0000000001164000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387932528.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387950210.0000000001167000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387970058.000000000116C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2387988202.000000000116D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388038737.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388065007.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388084206.000000000117E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388099463.000000000117F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388123896.0000000001192000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388138389.0000000001193000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388174818.000000000119B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388192414.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388241047.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388262935.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388301871.00000000011B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388605346.00000000011C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388656508.00000000011CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388674495.00000000011D4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388691750.00000000011DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388708925.00000000011DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388726785.00000000011E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388747649.00000000011EB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388768240.00000000011EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388810847.00000000011F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388831576.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388847710.00000000011F5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388865293.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388886350.00000000011F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388908493.00000000011FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388929568.0000000001204000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388950047.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388965577.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2388982872.0000000001215000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389011185.0000000001225000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389031601.0000000001227000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389051455.0000000001234000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389071487.0000000001237000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389118000.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389260975.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.0000000001273000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389380065.000000000127E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389550287.000000000128C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389628175.000000000128E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fd0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 0dd33179857245e95a0478ea31a613a8f1ed5152a577a6169fd2ab843d4f2b77
Instruction ID: ef5bb38a94158eb425993ea0734815a46cdceb769c008b9fd99c252028c10a46
Opcode Fuzzy Hash: 0dd33179857245e95a0478ea31a613a8f1ed5152a577a6169fd2ab843d4f2b77
Instruction Fuzzy Hash: 123157B1504206EFDB29CF59C888BCEBFB1FF18354F008529E956676A0C375A6A5CF90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 716, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 716, Parent PID: 4004COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 011595D5 Relevance: 1.6, APIs: 1, Instructions: 104
libraryCOMMON

Function 011B3494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
libraryCOMMON

Function 011B62F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 011B3767 Relevance: 4.6, APIs: 3, Instructions: 87
COMMON

Function 011B6510 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 011B399A Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 011B5E7C Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 011B38A1 Relevance: 3.0, APIs: 2, Instructions: 39
COMMON

Function 0115BFDA Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Function 01159737 Relevance: 1.6, APIs: 1, Instructions: 109
libraryCOMMON

Function 0115C01E Relevance: 1.6, APIs: 1, Instructions: 107
fileCOMMON

Function 0115C030 Relevance: 1.6, APIs: 1, Instructions: 106
fileCOMMON

Function 011B44FB Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 0115C06A Relevance: 1.6, APIs: 1, Instructions: 99
fileCOMMON

Function 0115C054 Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON