Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562588
MD5:	07366afe83f945d77fc65c8b2c8aa5f1
SHA1:	70d7f27ba7537d8721d1c270d56697cca944c9be
SHA256:	17c9be4df1800869592cc8b92eb5c1423e7f299b5c3ce034b75a71c9a0f55f99
Tags:	exeHealeruser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5400 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 07366AFE83F945D77FC65C8B2C8AA5F1)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E65EC3 CryptVerifySignatureA,

0_2_00E65EC3

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1265406238.0000000005250000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8A03F	0_2_00E8A03F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E03000	0_2_00E03000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0CA24	0_2_00E0CA24

Source: file.exe, 00000000.00000000.1256046615.0000000000C86000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this applicationFDS_WL_

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2802176 > 1048576

Source: file.exe

Static PE information: Raw size of xilneaxj is bigger than: 0x100000 < 0x2a6200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W;xilneaxj:EW;urakthdi:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ac939 should be: 0x2b7366

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: xilneaxj
Source: file.exe	Static PE information: section name: urakthdi
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C90AA7 push 5B90EABCh; mov dword ptr [esp], edx	0_2_00C92521
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E12DC1 push ebx; mov dword ptr [esp], ecx	0_2_00E12DC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E12DC1 push eax; mov dword ptr [esp], esi	0_2_00E14BC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1B0F5 push eax; mov dword ptr [esp], 7C7266BDh	0_2_00E1B0F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0A0F8 push eax; mov dword ptr [esp], 052D00BBh	0_2_00E0A100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0A0F8 push edx; mov dword ptr [esp], esp	0_2_00E0A10B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E070CA push 4583E7B7h; mov dword ptr [esp], edx	0_2_00E070DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E070CA push esi; mov dword ptr [esp], B1482161h	0_2_00E0714B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E140D5 push esi; mov dword ptr [esp], 6F6F0574h	0_2_00E140E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAC0AC push edi; mov dword ptr [esp], ebx	0_2_00EAC284
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAC0AC push 30BA3976h; mov dword ptr [esp], ebx	0_2_00EAC294
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E130AA push 4D0F4407h; mov dword ptr [esp], eax	0_2_00E130AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E130AA push 70E9FFF2h; mov dword ptr [esp], ebx	0_2_00E130B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC40BE push esi; mov dword ptr [esp], 04173837h	0_2_00EC4100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC40BE push 54F4B051h; mov dword ptr [esp], ecx	0_2_00EC4174
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC40BE push 0E19A84Eh; mov dword ptr [esp], ebx	0_2_00EC4193
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC40BE push eax; mov dword ptr [esp], edi	0_2_00EC41B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E07086 push 4583E7B7h; mov dword ptr [esp], edx	0_2_00E070DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E07086 push esi; mov dword ptr [esp], B1482161h	0_2_00E0714B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1A084 push 4A03DD13h; mov dword ptr [esp], ecx	0_2_00F1A132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0709A push 4583E7B7h; mov dword ptr [esp], edx	0_2_00E070DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0709A push esi; mov dword ptr [esp], B1482161h	0_2_00E0714B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0A076 push eax; mov dword ptr [esp], edi	0_2_00F0A0C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C92044 push edi; mov dword ptr [esp], 27904394h	0_2_00C9204B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E08070 push eax; mov dword ptr [esp], 4CC3FB33h	0_2_00E08074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1F06A push 47328A0Ch; mov dword ptr [esp], ebx	0_2_00F1F25A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED6029 push ecx; mov dword ptr [esp], 171A2759h	0_2_00ED60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C92003 push eax; mov dword ptr [esp], ecx	0_2_00C936AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8A03F push 157CCDF3h; mov dword ptr [esp], ecx	0_2_00E8A100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C91011 push edi; mov dword ptr [esp], ebp	0_2_00C91207
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C91011 push esi; mov dword ptr [esp], 3E57F53Ah	0_2_00C9120C

Source: file.exe

Static PE information: section name: entropy: 7.810338657977139

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07DB4 second address: E07DC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B84Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07DC4 second address: E07DCF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F0CC8E041D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB1D7 second address: DFB1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F0CC8C7B846h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0707B second address: E070A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F0CC8E041E2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0CC8E041E1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E070A6 second address: E070B0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0CC8C7B846h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07239 second address: E0723F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0723F second address: E07243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073A3 second address: E073BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0CC8E041DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073BA second address: E073C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073C0 second address: E073CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E097D7 second address: E097DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09A32 second address: E09A60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0CC8E041E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09A60 second address: E09A6A instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09C51 second address: E09C74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09C74 second address: E09CBD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jp 00007F0CC8C7B862h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0CC8C7B852h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09CBD second address: E09CCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09CCE second address: E09D1D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0CC8C7B848h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edx 0x00000011 push eax 0x00000012 jng 00007F0CC8C7B846h 0x00000018 pop eax 0x00000019 pop edx 0x0000001a pop eax 0x0000001b lea ebx, dword ptr [ebp+1244F6B5h] 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F0CC8C7B848h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jl 00007F0CC8C7B846h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACC6 second address: E2ACE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CC8E041E7h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACE3 second address: E2ACEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACEF second address: E2ACFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACFA second address: E2ACFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2ACFE second address: E2AD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8E041E7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF60B9 second address: DF60BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FC9 second address: E28FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FCD second address: E28FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FD6 second address: E28FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FDC second address: E28FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jl 00007F0CC8C7B846h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FF0 second address: E28FFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F0CC8E041D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28FFC second address: E29013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CC8C7B852h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292AC second address: E292B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292B0 second address: E292BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292BB second address: E292C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292C1 second address: E292C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292C7 second address: E292CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292CC second address: E292D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E292D1 second address: E292E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0CC8E041D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2963A second address: E29669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B84Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CC8C7B84Bh 0x00000010 jmp 00007F0CC8C7B850h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E297F6 second address: E297FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2997F second address: E29984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29AA6 second address: E29AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29AAA second address: E29ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007F0CC8C7B846h 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29ABB second address: E29AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29D46 second address: E29D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8C7B850h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F95A second address: E1F964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0CC8E041D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F964 second address: E1F968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F968 second address: E1F974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0CC8E041D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCBD4 second address: DFCBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCBD8 second address: DFCBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCBE4 second address: DFCBF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F0CC8C7B846h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2D5EA second address: E2D5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2EE6E second address: E2EE72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2EE72 second address: E2EE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CC8E041E0h 0x0000000b jp 00007F0CC8E041D8h 0x00000011 popad 0x00000012 jbe 00007F0CC8E041DEh 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7C7C second address: DF7C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36E1B second address: E36E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36E21 second address: E36E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36E25 second address: E36E31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC193 second address: DEC1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0CC8C7B846h 0x0000000a pop edi 0x0000000b jno 00007F0CC8C7B864h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0CC8C7B84Eh 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36348 second address: E3637F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E6h 0x00000007 jnp 00007F0CC8E041D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0CC8E041E3h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3637F second address: E36385 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36385 second address: E3638D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3638D second address: E363A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0CC8C7B84Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36508 second address: E36510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36510 second address: E36514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E366A1 second address: E366BB instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CC8E041E4h 0x00000008 jmp 00007F0CC8E041DEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E366BB second address: E366BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36B20 second address: E36B44 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0CC8E041EDh 0x00000008 jmp 00007F0CC8E041E1h 0x0000000d je 00007F0CC8E041D6h 0x00000013 push esi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36B44 second address: E36B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jno 00007F0CC8C7B846h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36B58 second address: E36B7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F0CC8E041D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38C1C second address: E38C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39025 second address: E39030 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39235 second address: E39239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E393F6 second address: E3940A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39790 second address: E397AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0CC8C7B84Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F0CC8C7B848h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E399B1 second address: E399B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E399B5 second address: E399BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39E42 second address: E39E48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39E48 second address: E39E4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39E4F second address: E39E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F0CC8E041D8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 jg 00007F0CC8E041D9h 0x0000002a sub dword ptr [ebp+122D30C1h], ebx 0x00000030 xchg eax, ebx 0x00000031 je 00007F0CC8E041E9h 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F0CC8E041DBh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3ADC1 second address: E3ADCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0CC8C7B846h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B69C second address: E3B6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C57A second address: E3C598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F0CC8C7B857h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E664 second address: E3E66B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E66B second address: E3E675 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0CC8C7B84Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D006 second address: E3D023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F0FF second address: E3F109 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F109 second address: E3F1AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0CC8E041E5h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F0CC8E041DFh 0x00000014 jns 00007F0CC8E041DCh 0x0000001a popad 0x0000001b nop 0x0000001c jmp 00007F0CC8E041E1h 0x00000021 pushad 0x00000022 mov bx, 606Dh 0x00000026 mov dword ptr [ebp+1244FF5Bh], ebx 0x0000002c popad 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F0CC8E041D8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov edi, ecx 0x0000004d movsx esi, cx 0x00000050 push eax 0x00000051 pushad 0x00000052 js 00007F0CC8E041DCh 0x00000058 jnc 00007F0CC8E041D6h 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F0CC8E041DFh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410F0 second address: E41107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41107 second address: E4110E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41C32 second address: E41C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41C36 second address: E41C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4217E second address: E42183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43256 second address: E43268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EEB4 second address: E3EEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EEB8 second address: E3EEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EEBE second address: E3EEC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3EEC4 second address: E3EEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E442BE second address: E442C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0CC8C7B846h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E433F1 second address: E434A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0CC8E041D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F0CC8E041E5h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F0CC8E041D8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d call 00007F0CC8E041E9h 0x00000032 or ebx, dword ptr [ebp+122D320Eh] 0x00000038 pop ebx 0x00000039 push dword ptr fs:[00000000h] 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007F0CC8E041D8h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a mov dword ptr fs:[00000000h], esp 0x00000061 mov edi, dword ptr [ebp+122D3227h] 0x00000067 mov eax, dword ptr [ebp+122D094Dh] 0x0000006d or bx, C14Fh 0x00000072 push FFFFFFFFh 0x00000074 mov bx, cx 0x00000077 nop 0x00000078 jg 00007F0CC8E041DEh 0x0000007e push esi 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E434A5 second address: E434AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E454A0 second address: E454AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E443F0 second address: E44418 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007F0CC8C7B846h 0x00000014 jbe 00007F0CC8C7B846h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0CC8C7B84Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48703 second address: E48709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E467A1 second address: E467A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E467A7 second address: E467AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E467AB second address: E467AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B17B second address: E4B182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B182 second address: E4B188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B188 second address: E4B1CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add dword ptr [ebp+1245353Ch], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 movzx edi, bx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F0CC8E041D8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jnl 00007F0CC8E041D6h 0x0000003c jnp 00007F0CC8E041D6h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B1CD second address: E4B1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B1D3 second address: E4B1EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B1EE second address: E4B1F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C2FF second address: E4C303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B362 second address: E4B368 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B443 second address: E4B447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C4DF second address: E4C4E9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C4E9 second address: E4C4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51EDB second address: E51F4B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0CC8C7B848h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, 5B4A34BBh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F0CC8C7B848h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e js 00007F0CC8C7B846h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F0CC8C7B848h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov ebx, dword ptr [ebp+122D391Dh] 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a js 00007F0CC8C7B846h 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51F4B second address: E51F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51F50 second address: E51F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E502A5 second address: E50330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0CC8E041D8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov di, 4CEAh 0x0000002b mov edi, dword ptr [ebp+122D3769h] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 jne 00007F0CC8E041DCh 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F0CC8E041D8h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 00000017h 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f mov eax, dword ptr [ebp+122D081Dh] 0x00000065 mov edi, dword ptr [ebp+122D36D5h] 0x0000006b push FFFFFFFFh 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 push edx 0x00000073 pop edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50330 second address: E50334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50334 second address: E5033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53F1A second address: E53F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51192 second address: E5121B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0CC8E041D8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F0CC8E041D8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov dword ptr [ebp+122D32E8h], esi 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F0CC8E041D8h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D343Ah], esi 0x0000005d mov dword ptr [ebp+122D1FE7h], ecx 0x00000063 mov eax, dword ptr [ebp+122D0B49h] 0x00000069 xor edi, dword ptr [ebp+122D1CBCh] 0x0000006f push FFFFFFFFh 0x00000071 mov di, dx 0x00000074 push eax 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 jng 00007F0CC8E041D6h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5313E second address: E53155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E53155 second address: E5315F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0CC8E041D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5315F second address: E531ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B84Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F0CC8C7B848h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 cmc 0x00000027 mov dword ptr [ebp+1244A215h], ebx 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov dword ptr [ebp+122D1FE7h], esi 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov di, cx 0x00000044 mov eax, dword ptr [ebp+122D1339h] 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007F0CC8C7B848h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 0000001Ah 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 mov ebx, 38B5F1B3h 0x00000069 push FFFFFFFFh 0x0000006b mov dword ptr [ebp+122D35ECh], ebx 0x00000071 xor ebx, dword ptr [ebp+122D30F9h] 0x00000077 nop 0x00000078 pushad 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E520B0 second address: E520CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E520CC second address: E520E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CC8C7B855h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521A0 second address: E521AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0CC8E041D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521AA second address: E521AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5DB second address: DEF5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF5E1 second address: DEF5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0CC8C7B852h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5FA26 second address: E5FA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F328 second address: E5F32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F32C second address: E5F351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0CC8E041DBh 0x0000000f jmp 00007F0CC8E041E0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F49C second address: E5F4B8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CC8C7B846h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 je 00007F0CC8C7B846h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F4B8 second address: E5F4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F618 second address: E5F643 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0CC8C7B84Ch 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0CC8C7B859h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F643 second address: E5F649 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70E86 second address: E70E90 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70E90 second address: E70E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70E96 second address: E70E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70E9A second address: E70E9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74B41 second address: E74B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75218 second address: E7521C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7567E second address: E75682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75682 second address: E756D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0CC8E041DEh 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F0CC8E041E1h 0x00000014 pop eax 0x00000015 pushad 0x00000016 jc 00007F0CC8E041D6h 0x0000001c push esi 0x0000001d pop esi 0x0000001e popad 0x0000001f js 00007F0CC8E041EAh 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 jmp 00007F0CC8E041E2h 0x0000002c push eax 0x0000002d push edx 0x0000002e push ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75841 second address: E75845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7597B second address: E75998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8E041E5h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75B0A second address: E75B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75CBD second address: E75CF3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0CC8E041D6h 0x00000008 jmp 00007F0CC8E041E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F0CC8E041E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75CF3 second address: E75CFD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75CFD second address: E75D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F0CC8E041DDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E75D10 second address: E75D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B9B7 second address: E7B9BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B9BD second address: E7B9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B9C1 second address: E7B9ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F0CC8E041DFh 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007F0CC8E041DBh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BE4A second address: E7BE4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7BFEE second address: E7BFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jno 00007F0CC8E041D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF11 second address: E7AF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF19 second address: E7AF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF21 second address: E7AF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF27 second address: E7AF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF35 second address: E7AF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F0CC8C7B84Ch 0x0000000d pop ecx 0x0000000e popad 0x0000000f jnp 00007F0CC8C7B889h 0x00000015 pushad 0x00000016 jmp 00007F0CC8C7B852h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF66 second address: E7AF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8E041DFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF7B second address: E7AF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F0CC8C7B846h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AF88 second address: E7AF8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FF3B second address: E7FF3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FF3F second address: E7FF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF45B0 second address: DF45BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF45BB second address: DF45C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF45C0 second address: DF45C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF45C5 second address: DF4617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0CC8E041D6h 0x0000000a jmp 00007F0CC8E041DDh 0x0000000f jmp 00007F0CC8E041E1h 0x00000014 popad 0x00000015 push ecx 0x00000016 jmp 00007F0CC8E041E1h 0x0000001b jng 00007F0CC8E041D6h 0x00000021 pop ecx 0x00000022 pop edx 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 pop ebx 0x0000002a push ecx 0x0000002b je 00007F0CC8E041D6h 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4617 second address: DF461D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84606 second address: E8460F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8460F second address: E84619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0CC8C7B846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84619 second address: E84640 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0CC8E041E1h 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007F0CC8E041D6h 0x00000015 pop esi 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37730 second address: E37734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37734 second address: E3774A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CC8E041D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007F0CC8E041E0h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37BF1 second address: E37C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B858h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C14 second address: E37C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C18 second address: E37C1E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37CF2 second address: E37D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [eax] 0x00000007 push esi 0x00000008 pushad 0x00000009 ja 00007F0CC8E041D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37E59 second address: E37E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E384B9 second address: E384CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CC8E041E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E384CF second address: E384D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E838C4 second address: E838D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0CC8E041D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83B96 second address: E83BA9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0CC8C7B84Eh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83CCC second address: E83CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83FDF second address: E83FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83FE3 second address: E83FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8E041E0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83FFD second address: E8405D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B852h 0x00000007 jnp 00007F0CC8C7B846h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0CC8C7B851h 0x00000014 jmp 00007F0CC8C7B859h 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F0CC8C7B855h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8405D second address: E8408E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jne 00007F0CC8E041F2h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8420D second address: E84212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89000 second address: E89013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F0CC8E041D6h 0x0000000d ja 00007F0CC8E041D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89013 second address: E89017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89183 second address: E8918E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8918E second address: E89198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0CC8C7B846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E895D4 second address: E895DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E895DA second address: E895E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E898A2 second address: E898A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E898A6 second address: E898AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E899F9 second address: E89A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0CC8E041D6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F0CC8E041D6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A0D second address: E89A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89A12 second address: E89A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89B73 second address: E89B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0CC8C7B84Ch 0x00000013 jns 00007F0CC8C7B846h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89B93 second address: E89B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89B99 second address: E89BA4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F0CC8C7B846h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89EA7 second address: E89EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89EAC second address: E89EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89EB2 second address: E89EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90899 second address: E9089F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B3D second address: E90B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B41 second address: E90B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0CC8C7B846h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90B57 second address: E90B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97E2F second address: E97E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97E34 second address: E97E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CC8E041E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E20E second address: E9E225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jne 00007F0CC8C7B846h 0x0000000b jmp 00007F0CC8C7B84Bh 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D2E4 second address: E9D2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D2EA second address: E9D309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0CC8C7B846h 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F0CC8C7B84Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38355 second address: E38359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38359 second address: E383D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F0CC8C7B857h 0x0000000c popad 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F0CC8C7B848h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f sub di, 56DCh 0x00000034 mov di, 7DBFh 0x00000038 push 00000004h 0x0000003a mov edi, 2494F4A4h 0x0000003f mov dword ptr [ebp+122D30C1h], eax 0x00000045 nop 0x00000046 jng 00007F0CC8C7B84Eh 0x0000004c jp 00007F0CC8C7B848h 0x00000052 push eax 0x00000053 jc 00007F0CC8C7B858h 0x00000059 push eax 0x0000005a push edx 0x0000005b jc 00007F0CC8C7B846h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D467 second address: E9D46E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA14AD second address: EA14B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA14B2 second address: EA14BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0CC8E041D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA14BE second address: EA14C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA14C9 second address: EA14CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA163E second address: EA1667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0CC8C7B856h 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F0CC8C7B846h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1667 second address: EA166B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA166B second address: EA166F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA166F second address: EA1675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA192E second address: EA1933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1933 second address: EA195D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F0CC8E041DBh 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1AC3 second address: EA1AD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F0CC8C7B846h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA602 second address: EAA60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA60C second address: EAA63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0CC8C7B84Bh 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0CC8C7B854h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA63A second address: EAA63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA875C second address: EA8760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8760 second address: EA8769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8F27 second address: EA8F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8F2E second address: EA8F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0CC8E041E6h 0x00000009 jo 00007F0CC8E041D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9201 second address: EA9222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F0CC8C7B846h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA94D9 second address: EA94F9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CC8E041DEh 0x00000008 push edi 0x00000009 jmp 00007F0CC8E041DDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA97E8 second address: EA9802 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F0CC8C7B846h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F0CC8C7B84Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9802 second address: EA9852 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CC8E041EEh 0x00000008 jmp 00007F0CC8E041DEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 jmp 00007F0CC8E041E6h 0x00000016 jno 00007F0CC8E041D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AF7 second address: EA9AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AFD second address: EA9B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA022 second address: EAA026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA026 second address: EAA03F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0CC8E041D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F0CC8E041DBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFADD second address: EAFAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB30E8 second address: EB30EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB323E second address: EB3242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3242 second address: EB3267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0CC8E041DDh 0x0000000d push edx 0x0000000e jc 00007F0CC8E041D6h 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007F0CC8E041D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB380D second address: EB3813 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBED1E second address: EBED27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBED27 second address: EBED2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCE17 second address: EBCE1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCE1B second address: EBCE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8C7B853h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F0CC8C7B84Ch 0x00000013 jo 00007F0CC8C7B846h 0x00000019 jbe 00007F0CC8C7B846h 0x0000001f popad 0x00000020 push ebx 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F0CC8C7B84Eh 0x00000028 pop ebx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD267 second address: EBD273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0CC8E041D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD562 second address: EBD582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0CC8C7B84Fh 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007F0CC8C7B846h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD85B second address: EBD871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DCh 0x00000007 jg 00007F0CC8E041D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD9C7 second address: EBD9CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD9CD second address: EBD9D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD9D3 second address: EBD9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD9D7 second address: EBD9DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD9DB second address: EBD9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB40 second address: EBDB63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E9h 0x00000007 jo 00007F0CC8E041D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB63 second address: EBDB84 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CC8C7B863h 0x00000008 jmp 00007F0CC8C7B857h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB84 second address: EBDB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB8F second address: EBDB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB95 second address: EBDB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDB9A second address: EBDBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0CC8C7B846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBDBA4 second address: EBDBB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F0CC8E041D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4626 second address: EC4646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F0CC8C7B857h 0x0000000b jmp 00007F0CC8C7B851h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4646 second address: EC464A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6699 second address: ED66C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8C7B84Ah 0x00000009 popad 0x0000000a jmp 00007F0CC8C7B858h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED66C3 second address: ED66D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F0CC8E041D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6105 second address: ED6109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED626B second address: ED626F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC968 second address: EDC97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0CC8C7B84Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC97A second address: EDC984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F0CC8E041D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE050 second address: EDE064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B850h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0428 second address: EE0431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0431 second address: EE043E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE043E second address: EE045F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0CC8E041E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE045F second address: EE0463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0463 second address: EE0475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 js 00007F0CC8E041DEh 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9767 second address: DF976B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF976B second address: DF977F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDFC7 second address: EEDFCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDFCD second address: EEDFE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F0CC8E041E4h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEDFE4 second address: EEDFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEEC1E second address: EEEC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8E041DDh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEEC36 second address: EEEC4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B853h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEEC4D second address: EEEC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEEC53 second address: EEEC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3721 second address: EF3725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF32B7 second address: EF32C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B84Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F8C second address: F09FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0CC8E041D6h 0x0000000a pop ebx 0x0000000b jmp 00007F0CC8E041E8h 0x00000010 popad 0x00000011 jne 00007F0CC8E04205h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0CC8E041DCh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09FC6 second address: F09FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E14 second address: F09E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E18 second address: F09E1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E1E second address: F09E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E24 second address: F09E38 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F0CC8C7B846h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E38 second address: F09E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09E3C second address: F09E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BC9B second address: F0BC9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE19 second address: F0BE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE1D second address: F0BE3C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F0CC8E041E1h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F0CC8E041D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13C66 second address: F13C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8C7B852h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13C82 second address: F13C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13C89 second address: F13CA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8C7B859h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13CA8 second address: F13CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1334F second address: F13355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13355 second address: F1335B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1335B second address: F13360 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13360 second address: F13366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13366 second address: F1337B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F0CC8C7B84Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F134B7 second address: F134BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F134BF second address: F134C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13628 second address: F13642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0CC8E041D6h 0x0000000a jmp 00007F0CC8E041DFh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13642 second address: F1364D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0CC8C7B846h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F137C5 second address: F137DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F0CC8E041E3h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F189FE second address: F18A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18A02 second address: F18A0C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0CC8E041D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18A0C second address: F18A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18A12 second address: F18A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0CC8E041E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183C5 second address: F183CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183CB second address: F183CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183CF second address: F183E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0CC8C7B84Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183E2 second address: F183FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F0CC8E041E3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183FB second address: F183FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F183FF second address: F18405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B673 second address: F1B696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0CC8C7B857h 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B696 second address: F1B6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0CC8E041D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DCC0 second address: F1DCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F0CC8C7B858h 0x0000000d jmp 00007F0CC8C7B84Dh 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DCEE second address: F1DCF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F185E5 second address: F185F7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0CC8C7B846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F185F7 second address: F185FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18779 second address: F18783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18783 second address: F1878D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0CC8E041D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB82 second address: F1DB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0CC8C7B846h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F0CC8C7B846h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB97 second address: F1DB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8DAED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8B046 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E377B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8DA1B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EC78B5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C95610 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5510000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E070CA rdtsc

0_2_00E070CA

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6376

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E6A1B0 GetSystemInfo,VirtualAlloc,

0_2_00E6A1B0

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E07220 Start: 00E07243 End: 00E0723F

0_2_00E07220

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E070CA rdtsc

0_2_00E070CA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C8B9B0 LdrInitializeThunk,

0_2_00C8B9B0

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: pq-wProgram Manager
Source: file.exe, 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: opq-wProgram Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562588
Start date and time:	2024-11-25 18:28:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, ctldl.windowsupdate.com, time.windows.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.474389453453904
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'802'176 bytes
MD5:	07366afe83f945d77fc65c8b2c8aa5f1
SHA1:	70d7f27ba7537d8721d1c270d56697cca944c9be
SHA256:	17c9be4df1800869592cc8b92eb5c1423e7f299b5c3ce034b75a71c9a0f55f99
SHA512:	139106e52db5f59f51d27ab6bc82ed280ffa645eb639465dd5e53ecb82b1c3cd3f83af6c1b86dc32f1f663b7c1e9b3eea3f8726607b3d41ee1d8d7b74a28b2b0
SSDEEP:	49152:IdBiljB2VHnRnD79+h7jeFk4z3YD652lrlwq7:IdBMjB2VHnRnD79Sd4A65wSq
TLSH:	E5D53A92AC4561CFDC8A27788437CE86699D43F90B2058C3B83D78FABD67DC516B9C24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....9.*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6b4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0CC907132Ah
push fs
sub al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0CC9073325h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	681c1774664a19cc166f0fdd05abf21f	False	0.93359375	data	7.810338657977139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xilneaxj	0xa000	0x2a8000	0x2a6200	c309af98d6f2d31d71bab24054d5566d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
urakthdi	0x2b2000	0x2000	0x400	fc54ca6ded6284c5f1cc8f89322095dd	False	0.765625	data	5.939372187654003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b4000	0x4000	0x2200	9b10d5f99c314e168dd82a7785f09bbe	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	12:28:59
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc80000
File size:	2'802'176 bytes
MD5 hash:	07366AFE83F945D77FC65C8B2C8AA5F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	5.9%
Signature Coverage:	6.9%
Total number of Nodes:	202
Total number of Limit Nodes:	16

Executed Functions

Function 00E6A1B0 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11645FEC), ref: 00E6A1BC
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00E6A21D

Memory Dump Source

Source File: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: ca20a12e7a91c7b62347c22cddb6b6ccdbbfa558bfb9ebb8c49cf3a9d97029f1
Instruction ID: 5eebd8b983bbeb7603e749e519d61041cce494d2cd14cfed52a20ef7c90ae999
Opcode Fuzzy Hash: ca20a12e7a91c7b62347c22cddb6b6ccdbbfa558bfb9ebb8c49cf3a9d97029f1
Instruction Fuzzy Hash: 9D4121B1D80206AFE725CF60D845BDAB7ECBB4C781F055162A203EE9D2E77195D08FA1

Function 00C8B9B0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676eed2f1f89b58062dc52291eb118886cafc4860e04a3ea6f868b13b01fb55a
Instruction ID: 589731e6fc8523b351ea8f021637e20bdb171e6322d9ca59d7fd4d53fcd54597
Opcode Fuzzy Hash: 676eed2f1f89b58062dc52291eb118886cafc4860e04a3ea6f868b13b01fb55a
Instruction Fuzzy Hash: 3E515773D00A25CFCB28AF2888503AE77A1EB44728F1A4125CC669B795E3395D9497CC

Function 00E12DC1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00E12E19
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00E12E40
GetNativeSystemInfo.KERNELBASE(?), ref: 00E12E97

Strings

{@}>, xrefs: 00E14C03

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: {@}>
API String ID: 1247124224-3054530385
Opcode ID: 4bb662af8b770f8c3184e009ca200bcf76df110632a5091ad31d4d5f34a98fc0
Instruction ID: 3682d705816ea1ee7d03e11afa5ee5a5e42f763bcf4cfe784798f6419da9b9e7
Opcode Fuzzy Hash: 4bb662af8b770f8c3184e009ca200bcf76df110632a5091ad31d4d5f34a98fc0
Instruction Fuzzy Hash: 56310CB140850E9FEF26DF54D845BEF77A5EF04319F40142AEA8292940DB764CE4CF59

Function 00E6258B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00E6269C
LoadLibraryExA.KERNELBASE(?,?,?,?,?,?,?,?,00000000), ref: 00E626B0

Strings

.exe, xrefs: 00E625F7
1002, xrefs: 00E62666

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .exe$1002
API String ID: 1029625771-4238571270
Opcode ID: 4d6f9ad849bccd061a9eeabc65d5f060d124ae1cf72647e7f3f84bc2d5f17e88
Instruction ID: be5a510d0799ebc01a6b58896b0e1e406ad2661255be6d04ca07ed03e537fc86
Opcode Fuzzy Hash: 4d6f9ad849bccd061a9eeabc65d5f060d124ae1cf72647e7f3f84bc2d5f17e88
Instruction Fuzzy Hash: 8D318D31884616EFCF25AF50F905AAE7BB5FF04394F10A16DFA02B6161C73199A0DF92

Function 00E653EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(014103CC,-11645FEC), ref: 00E65464
GetFileAttributesA.KERNEL32(00000000,-11645FEC), ref: 00E65472

Strings

@, xrefs: 00E65417

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: dae458f58690799b5632a2fd9a949e96a9805d6f30907fd2b7c95ef0c700cefe
Instruction ID: d930b6573529a7bba45ed2dab54ae283766241a1833d9f28e401c9188da1d968
Opcode Fuzzy Hash: dae458f58690799b5632a2fd9a949e96a9805d6f30907fd2b7c95ef0c700cefe
Instruction Fuzzy Hash: 9201D172684A04FADF229F68E90D7EC7EB0AF403C6F20A1A4E55375091CBB04AD1EB40

Function 00E65607 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(014103CC,?,-11645FEC,?,?,?,?,-11645FEC), ref: 00E656B9

Part of subcall function 00E655B9: IsBadWritePtr.KERNEL32(?,00000004), ref: 00E655C7

CreateFileA.KERNEL32(?,?,-11645FEC,?,?,?,?,-11645FEC), ref: 00E656D9

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 910cac193ed106b2a064ba9444af60fb73c0bcf51155c3385ec0729a5ff522ad
Instruction ID: 20b3fdb11028dcd451c25995e33058baf68c82a5cf6862f3457a94d81068077d
Opcode Fuzzy Hash: 910cac193ed106b2a064ba9444af60fb73c0bcf51155c3385ec0729a5ff522ad
Instruction Fuzzy Hash: 68115932680A0AFBCF229F90ED09BDD7F72BF14388F506015B902340A1C33289A1EB81

Function 00E62A91 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00E62A23,?,00000000,00000000), ref: 00E62B4E
GetModuleHandleA.KERNEL32(00000000,?,?,00E62A23,?,00000000,00000000), ref: 00E62B5C

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cf26d446d2418ce546d5a3139a5ce43c173b8f611b86df78547c4f57b010360a
Instruction ID: 44fdc9d38a418f72d002db1ea743561a1f1dd3552be8108a025f63c68face0bc
Opcode Fuzzy Hash: cf26d446d2418ce546d5a3139a5ce43c173b8f611b86df78547c4f57b010360a
Instruction Fuzzy Hash: 3A11A530185E15EEEF31DF64E80DBA97BB1FF203C9F00A219EA06644D1C7B694E1DA91

Function 00E64F73 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(-11645FEC), ref: 00E64F80
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E64FE6

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CurrentDuplicateHandleProcess
String ID:
API String ID: 1009649615-0
Opcode ID: 18253eff2c66211258be152d10c43289250a053126e6e74f1252f44dc2dcfa62
Instruction ID: 2e380bbc54e6da778c38ed105271c152c06d8014ed5d397fb86cecd7f1b47e15
Opcode Fuzzy Hash: 18253eff2c66211258be152d10c43289250a053126e6e74f1252f44dc2dcfa62
Instruction Fuzzy Hash: 3101FB7324014AAB8F226FA4FD49CDF3BB5BF987947006A15F905A4051C732D561EB61

Function 00E6ABDC Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba9a3e08ca8846938f42e22efce2513b9fa76c5f153e64d2d24f9e38768513d
Instruction ID: f1f3854384146882e373ceade0487f40196da303697b692d33d499f178ab5403
Opcode Fuzzy Hash: 1ba9a3e08ca8846938f42e22efce2513b9fa76c5f153e64d2d24f9e38768513d
Instruction Fuzzy Hash: 39414A71D40209EFDB25DF14E944BAABBB1FF40359F286065E902BA991C331AC90DF52

Function 00E635F2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00E636A7

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 39678522b8c48e7547c37ae12f5e66ce24eb3fa063cac43ffb5396f9eafcbee1
Instruction ID: 850186093665e7342630712a8e5e4646440469e7a0718d516bf496158da17ab2
Opcode Fuzzy Hash: 39678522b8c48e7547c37ae12f5e66ce24eb3fa063cac43ffb5396f9eafcbee1
Instruction Fuzzy Hash: 4B3170B1940204FEEB21DF64EC85F9EBBB8FF44394F209269F505BA191C771AA51CB50

Function 00E62E0E Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E62E90

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb9555f0a7fcfa5a8bd71aeb169baeab56b64f30583ca7cbd1d9624285ee30ab
Instruction ID: f351858f60e4ab57deccf9653c5be7446213fb8730147ab1bfbbdeb517be784e
Opcode Fuzzy Hash: eb9555f0a7fcfa5a8bd71aeb169baeab56b64f30583ca7cbd1d9624285ee30ab
Instruction Fuzzy Hash: 6E31D771680604BEEB219F64EC46F9ABBB8FB44768F204369F711BA1D1C3B2A541CB50

Function 00E6A929 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,00000000), ref: 00E6A9D6

Memory Dump Source

Source File: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: be8edf0dadf1e8335d5e658068fe74cbabc685c2f4f41ba03f00c1104f35f5c0
Instruction ID: 2c2da425b7a917d81796f764e268faf78d0e6bd838ccd09b95e9aa265fb1774b
Opcode Fuzzy Hash: be8edf0dadf1e8335d5e658068fe74cbabc685c2f4f41ba03f00c1104f35f5c0
Instruction Fuzzy Hash: D011DA71E412259FEB204A44AD48BEA777CEF44798F1A9076E505B2040D7749D80CFA7

Function 054D0D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054D0DCD

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 2644972884f233f4362690b783c72030334430cac84e3ad15efb795793e04ef3
Instruction ID: c1a3aa0684bcc719d506ed8a13fc678f40811a9e0c3453e7756d997630a84590
Opcode Fuzzy Hash: 2644972884f233f4362690b783c72030334430cac84e3ad15efb795793e04ef3
Instruction Fuzzy Hash: 6821F5B6C012199BCB10CF9AD889BDEFBB5EB88310F14825AD919AB344D774A541CBA4

Function 054D0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054D0DCD

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9e63e61a9c8d822abf9462ed0cd27572dc120adb2d86000dd24b59966ae56d0c
Instruction ID: 0a46773e1ec7ad109d7f57839a35d47ea6bbeb1bec6898da6050a763cdd06a54
Opcode Fuzzy Hash: 9e63e61a9c8d822abf9462ed0cd27572dc120adb2d86000dd24b59966ae56d0c
Instruction Fuzzy Hash: 732104B6C012199FCB10CF9AD888ADEFBB5FB88310F14825AD919AB344D734A541CBA4

Function 054D1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 054D1580

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 2fa0d133e3217a31b5157589b9d8d1090b88f74af42ad9cc936c46656e7de929
Instruction ID: dffc1fca3c1a8e45ab7230010e02fb8c1b2750c31e13d21b9b1919b8c9df0149
Opcode Fuzzy Hash: 2fa0d133e3217a31b5157589b9d8d1090b88f74af42ad9cc936c46656e7de929
Instruction Fuzzy Hash: 112103B5D002098FDB10CF9AC585BDEFBF4AB48320F10852AE959A3250D778AA45CFA1

Function 054D1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 054D1580

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 13af7243b62c53b06fd8e6e0073764f5f23204073991488ad770be6a9211d686
Instruction ID: 152be99760ab9d6ec07441e38a2606476f1df722abc922235d45f195d0c94540
Opcode Fuzzy Hash: 13af7243b62c53b06fd8e6e0073764f5f23204073991488ad770be6a9211d686
Instruction Fuzzy Hash: B11117B1D003498FDB10CF9AC444BDEFBF4EB48320F10812AE959A3250D378A544CFA5

Function 00E6613F Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?), ref: 00E661C6

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3f3c13aa56d23166cc34395db60fdf8240fe8a6f6cc766678543aabc3e4c8091
Instruction ID: fd34e0debea33ec182c67b7dd7bce09379350c3616029b8bb6de54637d93c117
Opcode Fuzzy Hash: 3f3c13aa56d23166cc34395db60fdf8240fe8a6f6cc766678543aabc3e4c8091
Instruction Fuzzy Hash: 3511397259020AEFCF22AFA4EC09D9F3FA6BF4A3C4B005111FA1565022C736D571EBA1

Function 00E65F27 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285de6ca3b5801e01bb98836a7beeb4b685b9b75263bc86d6d7adcd016200033
Instruction ID: 058d5bae3ebeaea01bb7a31f479d203a4a87ea36c287eda44b31e0aa806fa7cb
Opcode Fuzzy Hash: 285de6ca3b5801e01bb98836a7beeb4b685b9b75263bc86d6d7adcd016200033
Instruction Fuzzy Hash: 30115E7238450AEFCF129FA4E909A9E3BA5BF45384F146511F902A6062C775C661EF50

Function 054D1301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054D1367

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: f64ea881a11c2472197ed13c5180d3b87e0caeee45189d9d6e4952aa064ab7ba
Instruction ID: 6ddb0929251b9d3723eee6c3468be6e34ac50eee376f47a0153b49571b1d6115
Opcode Fuzzy Hash: f64ea881a11c2472197ed13c5180d3b87e0caeee45189d9d6e4952aa064ab7ba
Instruction Fuzzy Hash: CC111675800249CFDB10DF9AD449BDEFBF4EB48320F15856AD918A3250C778A544CFA5

Function 054D1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054D1367

Memory Dump Source

Source File: 00000000.00000002.1401002575.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: a185b0c3b93207a7cd243dde13459484980fa68c323a545bee0f5961e1c55a04
Instruction ID: fcf67b49714fe79bc7c2e2dcc7fe89b1b56509c6ff821ede96908ca5d39b6721
Opcode Fuzzy Hash: a185b0c3b93207a7cd243dde13459484980fa68c323a545bee0f5961e1c55a04
Instruction Fuzzy Hash: CC11F5B1C003498FDB20DF9AD545BDEFBF8EB48320F14846AD958A3650D778A944CFA5

Function 00E09ADD Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09B1C

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ee67a0aa5f7568eca46aa3b6749316d4bdb6ed949a47a85f7572af0896542106
Instruction ID: f729d1dd95b5be56627ff39c694dc6e2fb2f57a7e96f515403c19dd47ccdc945
Opcode Fuzzy Hash: ee67a0aa5f7568eca46aa3b6749316d4bdb6ed949a47a85f7572af0896542106
Instruction Fuzzy Hash: E4F059B32C91666DDF51CF907D899EE3B78D7937B1730595AE005BB0C3C501A88A8B68

Function 00E6580B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?,00000400,?,?,?,00E6353A,?,?,00000400,?,00000000,?,00000000), ref: 00E65877

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9c4f4c38b5140587bc0c6271af55626bc3b44895da8f5127e8d7ac209f3d9ee3
Instruction ID: ae1bf3114ffce586df6055b3b4599fa0bc397d9b31b79c24f834751defc27e3d
Opcode Fuzzy Hash: 9c4f4c38b5140587bc0c6271af55626bc3b44895da8f5127e8d7ac209f3d9ee3
Instruction Fuzzy Hash: 27F0EC3368050AEFCF166F98ED09D9E3F66FF94794F005521F9016A462C732C9A1EB61

Function 00E09A90 Relevance: 1.5, APIs: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09B1C

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cf23fe32597e72854fefdd14857398d971ae6fae15e20ea9201349fdb8b9f82a
Instruction ID: 039e0c38fd1ec8bdadae6f96810bdc786c7b418eb4c5ab726c9816381f84a529
Opcode Fuzzy Hash: cf23fe32597e72854fefdd14857398d971ae6fae15e20ea9201349fdb8b9f82a
Instruction Fuzzy Hash: 3DE061B35C61255DDF11CF907EC59EE7768DB436B0B305452E405D70C3C150988A9B68

Function 00E62B7A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00E62BDE

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 774c64c7fd85e3ad6e1d35f2b78731845dc16cbc5104a4291d263c89154b3e35
Instruction ID: fc998decf01e20939dd6a19a154d582039c30a75ff6295e949869a8a8dbc5e2c
Opcode Fuzzy Hash: 774c64c7fd85e3ad6e1d35f2b78731845dc16cbc5104a4291d263c89154b3e35
Instruction Fuzzy Hash: 06F09071244604AFDF10DF54E945AAA3BA0FF14390F109459FF15A9052C731D590DB51

Function 00E09ACD Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09B1C

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8eac72cd7055a4f2ea95b9c410dacf5cb4fafdb324e007c7212981d5c98c1754
Instruction ID: 9f5f74766948a621e07bd559fafbbad7bf5f823cce812143092f12c1e031d1f4
Opcode Fuzzy Hash: 8eac72cd7055a4f2ea95b9c410dacf5cb4fafdb324e007c7212981d5c98c1754
Instruction Fuzzy Hash: 1EE0CD73348057ADD7439F646DA54FF37E8D8D7731370916AD402B70D7D6816C419984

Function 00E09AFB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09B1C

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bbc25409a90d05b9de0a3424058d59e51f7f452f233a7f2b94c92e3267288874
Instruction ID: 228d01703bd95a51539b7aa80e1feacdb05586e4416000bfda2f2e93fdce34c0
Opcode Fuzzy Hash: bbc25409a90d05b9de0a3424058d59e51f7f452f233a7f2b94c92e3267288874
Instruction Fuzzy Hash: 0ED02B321D24595EC7039F206D901ED77A9E8033307A450F5C4007B483D602BC41CFC0

Function 00E09909 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09915

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1c4e38a2c13f8495666172f9acc981ccb368289b7d6acac3990d1c2eb50a12fa
Instruction ID: 1c650f1eb82cc3f5af49ffba9bc8c5b04063749017cba487bc422bf9bc82bead
Opcode Fuzzy Hash: 1c4e38a2c13f8495666172f9acc981ccb368289b7d6acac3990d1c2eb50a12fa
Instruction Fuzzy Hash: 15E02B7B9983551AC705BF71CC453ADB990EB6AB34B70305CF450B30C3D1EA9C988A58

Function 00E09D3F Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00E09D4D

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0e5992ffe7d879c5dd63b94610b11eb0132b77955598875819fc8263ba8e5d6c
Instruction ID: 7243046e7a6bf78aac39db092eac1f6f096c34a409207dbfb275c540c5588347
Opcode Fuzzy Hash: 0e5992ffe7d879c5dd63b94610b11eb0132b77955598875819fc8263ba8e5d6c
Instruction Fuzzy Hash: 66D09736A843960ACB02AF3488D226C7A40EF5A730F30202DD010D31A3E1FBDC06AE09

Function 00E13191 Relevance: 1.5, APIs: 1, Instructions: 13libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00E146F4

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8eca4d012db76dd7df72fbdaeccc66461de86a4e1d39544f768a6ed605c315ad
Instruction ID: 0164174df811c12fe814010b6b4193310ba6bc6693507814677bd6ffef4b35fa
Opcode Fuzzy Hash: 8eca4d012db76dd7df72fbdaeccc66461de86a4e1d39544f768a6ed605c315ad
Instruction Fuzzy Hash: F0D0A9F600CA018FCB045A4084087FE72E8EFA0320F22882DA2C210B50EA3408C18A62

Function 00E6A553 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00E6A54F,?,?,00E6A255,?,?,00E6A255,?,?,00E6A255), ref: 00E6A573

Memory Dump Source

Source File: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b62dd8f78b5284a57da3f4c318a58522276ab7a08989f36373468eed02aa9740
Instruction ID: 4177992b2a1b066db662ae6930c71e45dab7e628676e53beada5b4e9a9bc0f48
Opcode Fuzzy Hash: b62dd8f78b5284a57da3f4c318a58522276ab7a08989f36373468eed02aa9740
Instruction Fuzzy Hash: DEF081B1900205EFD720CF44D904B99BBE4FF89791F1980A9F44BAB6E1E37198D08F60

Function 00E67D3D Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000,00E646F0), ref: 00E67D5A

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 349b2cddc4a7022f11e5d068f3ecfd48315ac6b1ac1eddadc1585e0155411484
Instruction ID: e834e7bd96b67ee978defef5a84bf844d80f4825f0a0b5191abca17c029ef107
Opcode Fuzzy Hash: 349b2cddc4a7022f11e5d068f3ecfd48315ac6b1ac1eddadc1585e0155411484
Instruction Fuzzy Hash: 8401AD31988212CFDB39EE24D115365B6A4BF8B3A8F10585AC4836E6C6C73098D4CB80

Function 00E63C0C Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00E635CF,?,?,00E635CF,?), ref: 00E63C4A

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8d3c47c1717e7aa0f9d0578f83564106663c692ec264b594cc35c1771e3fdd37
Instruction ID: bd6fe1aefe6e58d78e146a01ee73c7aac1528f0583f21956f4a3d9fa11fd3522
Opcode Fuzzy Hash: 8d3c47c1717e7aa0f9d0578f83564106663c692ec264b594cc35c1771e3fdd37
Instruction Fuzzy Hash: 37E086B2684516A6CE217B7CF94DD8FAEA8AFD17D47006232F402B9047CB31C2A1E770

Function 00C8E7DF Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C8E805

Memory Dump Source

Source File: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 65390f18a65eac7cd58e3ae98443dd406b85862fb78b223e0a238044407a2fa4
Instruction ID: 77551766107a5ec67697d08bde195fa8f33c342f3d7c2e88ab29057dcfd9ad7d
Opcode Fuzzy Hash: 65390f18a65eac7cd58e3ae98443dd406b85862fb78b223e0a238044407a2fa4
Instruction Fuzzy Hash: 00E0BF3651C209CFD74AAF34C48A66E77E1FF15311F264A1DE892C26D0EB726C20CA4E

Function 00C8EA1F Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00C8EA27

Memory Dump Source

Source File: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b71d5d851064456dd0dd3bc85179a0c518f2a303a81894c89e5f70dba7cc8a99
Instruction ID: 8d64c9d868122731cb9c6ac4149e8212e977208912ddfad874ddee7f5202b40d
Opcode Fuzzy Hash: b71d5d851064456dd0dd3bc85179a0c518f2a303a81894c89e5f70dba7cc8a99
Instruction Fuzzy Hash: B7D0E27014C208EFEB013F508848A7DBAA1EB44305F21082DA8C186260D3320C60AB0A

Function 00E62CD1 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00E62CD7

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7849d34ab04cb91212728309c2487a48f7767c8e3663e13c465bdbd06d743832
Instruction ID: fee6bde2da1390fffecb1ea8f1d07c3c8528ce222a661f11e3b75eb669823da8
Opcode Fuzzy Hash: 7849d34ab04cb91212728309c2487a48f7767c8e3663e13c465bdbd06d743832
Instruction Fuzzy Hash: 8CB09271000908BBCF02BF61EC4688EBFE9BF59798B008120BA46590228B72E9609B90

Non-executed Functions

Function 00E0CA24 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

G, xrefs: 00E0D3E6

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: fc9efcc830acd08a862637d3a95bdbab482d11532e74d7a11ac48b5ac8e946da
Instruction ID: f0b797126ac9cc01bbb92c7c1fa2a07675451029d1417a1fca9fd02b90674683
Opcode Fuzzy Hash: fc9efcc830acd08a862637d3a95bdbab482d11532e74d7a11ac48b5ac8e946da
Instruction Fuzzy Hash: A9A178B260C30ADFE7119F64CC057BEBBE5EB41310F34592AE982966C0E6754C90DB16

Function 00E65EC3 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00E65F0A

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 0ce51f7604a6b2bc04774ecdd33c37f19eed332158a0154cedc365340ed07845
Instruction ID: ccfd86b408f49687d59a3587856bc82691a02f7d11063cb84b029be64d1d4651
Opcode Fuzzy Hash: 0ce51f7604a6b2bc04774ecdd33c37f19eed332158a0154cedc365340ed07845
Instruction Fuzzy Hash: 33F0F83260560AEFCF12CF94D904A8D7BB2FF59344F108129FA16A6151D776D660EF40

Function 00E03000 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

!o_}, xrefs: 00E0304B

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID: !o_}
API String ID: 0-1775687488
Opcode ID: 85143aef5d12d156756ae5ed53a5c891ed00ac147563f79786431f677f0f2259
Instruction ID: efd78ca15b8b9a4c09ddfd5d8fd8838aabcebb350408c8a0c05d61f7bd7a98ee
Opcode Fuzzy Hash: 85143aef5d12d156756ae5ed53a5c891ed00ac147563f79786431f677f0f2259
Instruction Fuzzy Hash: AE21D5F37092045BE304AE3DDC8663AF7D6EFE5650F5A8A3DD2C1C3744E93494058656

Function 00E07220 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1a1bfb788d0dd2e4e981fe2bb2cf3a3a2782b30750329e7c2b866bc8a91d4b
Instruction ID: 3f4df186b1077fa3bcf7b6ed7881922beb6870c53c30901a233dc0dd79dbfcaf
Opcode Fuzzy Hash: 5e1a1bfb788d0dd2e4e981fe2bb2cf3a3a2782b30750329e7c2b866bc8a91d4b
Instruction Fuzzy Hash: C641E2F260C344AFE305AF19EC41A7AFBE8EF86360F15482EE6C5C7251E63598448793

Function 00E070CA Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2552e971f673ee8ac8515afa66ddba5f7cc980987c701b936c67216ab42a4b7a
Instruction ID: fc06a6399b1362ed4fddcc1f33d41dbb75bb1f4c0e066bcfaf2fea5762960728
Opcode Fuzzy Hash: 2552e971f673ee8ac8515afa66ddba5f7cc980987c701b936c67216ab42a4b7a
Instruction Fuzzy Hash: 7F3137B210CA00DFE706BF19D8426BEFBE1EF98310F12892DE2D482654D7398484CB87

Function 00E8A03F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4c639f10d9f6688c0ba31c8cb75d439f2d5e5390ceab929fa77e3e0ae086af
Instruction ID: f9d03626a18501639fdca747212674b0f7557f8bc0e624407888a42e82b6c0d1
Opcode Fuzzy Hash: 2a4c639f10d9f6688c0ba31c8cb75d439f2d5e5390ceab929fa77e3e0ae086af
Instruction Fuzzy Hash: 8231D3B250C6049FE309BF28D8867BEFBE4EF54310F06492DE6C282A50DB355440CB97

Function 00E6453B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00E655B9: IsBadWritePtr.KERNEL32(?,00000004), ref: 00E655C7

wsprintfA.USER32 ref: 00E64581
LoadImageA.USER32(?,?,?,?,?,?), ref: 00E64645

Strings

%8x, xrefs: 00E6457C, 00E6457F
%8x, xrefs: 00E6460F, 00E64642

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: ImageLoadWritewsprintf
String ID: %8x$%8x
API String ID: 416453052-2046107164
Opcode ID: 060efd07a2aef5eb8896617879bfb20f06958ffcf94aac70dc94f216401c71d7
Instruction ID: 0541d9cf99099f5052fe8de0b4282d45ae8257f08a14a5264631d27f681cdb5e
Opcode Fuzzy Hash: 060efd07a2aef5eb8896617879bfb20f06958ffcf94aac70dc94f216401c71d7
Instruction Fuzzy Hash: 23311772A4010AFFCF119F94EC49EEEBFB9FF84740F108125B611A61A1C7719A61DB50

Function 00E6510C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(014103CC,00004020,00000000,-11645FEC), ref: 00E651F9

Strings

@, xrefs: 00E65138

Memory Dump Source

Source File: 00000000.00000002.1398911000.0000000000E62000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1398465548.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398487384.0000000000C82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398503752.0000000000C86000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398519763.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398536179.0000000000C94000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398550649.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398565428.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398668646.0000000000DEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398683943.0000000000DED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398702948.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398733489.0000000000E15000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398747197.0000000000E18000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398761535.0000000000E19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398775220.0000000000E1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398790252.0000000000E22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398805270.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398818539.0000000000E24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398831692.0000000000E26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398844923.0000000000E28000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398859225.0000000000E2B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398878235.0000000000E40000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398896247.0000000000E55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398925730.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398939401.0000000000E6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398952595.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398969789.0000000000E7E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398982832.0000000000E80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1398996491.0000000000E81000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399011466.0000000000E85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399024651.0000000000E86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399038287.0000000000E8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399051835.0000000000E92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399064605.0000000000E95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399082069.0000000000E9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399102633.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399117320.0000000000E9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399133624.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399148844.0000000000EB2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399162738.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399177246.0000000000EBF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399190178.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399204647.0000000000ECD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399217910.0000000000ECF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399233147.0000000000ED9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399247493.0000000000EDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399271877.0000000000F0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399285320.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F16000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399313009.0000000000F21000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399342391.0000000000F32000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 96f860c5739c2208076570d774770957322f91a3432c4080879c13f784942a3e
Instruction ID: 72bd8949a96440881bc5fd8b55a9818218445e4e80ed959041f06529369958b3
Opcode Fuzzy Hash: 96f860c5739c2208076570d774770957322f91a3432c4080879c13f784942a3e
Instruction Fuzzy Hash: 0F318DB2644B05EFDF258F54E848B8EBBB0FF04384F109519E956672A1C371A6A5CF80

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 5400, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 5400, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
file.exe

Function 00E6A1B0 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 00E12DC1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
registryCOMMON

Function 00E6258B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83
libraryCOMMON

Function 00E653EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00E65607 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00E62A91 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 00E64F73 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00E6ABDC Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00E635F2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00E62E0E Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 00E6A929 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 054D0D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 054D0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 054D1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON